The Chamilo LMS password recovery mechanism prior to version 1.11.38 and between 2.0.0-alpha.1 and 2.0.0-RC.3 uses a weak token generation method for password resets. Tokens are generated as sha1 hashes of the user's email address, lacking any random component, expiration, or rate limiting. This design flaw enables attackers who know a user's email to generate valid reset tokens and change passwords without authentication. The vulnerability is tracked as CVE-2026-33707 with a CVSS 3.1 score of 9.4 (critical). It is resolved in versions 1.11.38 and 2.0.0-RC.3.

An attacker can reset any user's password without authentication if they know the user's email address, leading to full account compromise (confidentiality and integrity impact) and limited availability impact. This allows unauthorized access to user accounts and potentially sensitive information within the LMS.

Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where the password reset mechanism has been fixed to use secure token generation with randomness, expiration, and rate limiting. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the vulnerability is fixed in these versions. No other mitigation is indicated.