CVE-2026-33736 is an authorization bypass vulnerability in chamilo-lms prior to version 2.0.0-RC.3. It allows any authenticated user, including those with limited privileges (e.g., students), to enumerate all users on the platform and retrieve sensitive personal information such as email addresses, phone numbers, and user roles by accessing the GET /api/users endpoint. This exposure includes administrator accounts. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). The issue was resolved in version 2.0.0-RC.3.

The vulnerability allows unauthorized disclosure of personal information of all platform users, including administrators. This could lead to privacy violations and potentially facilitate further targeted attacks due to exposure of user contact details and roles. There is no impact on system integrity or availability reported.

Upgrade chamilo-lms to version 2.0.0-RC.3 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved starting from this version, applying this update fully mitigates the risk. Patch status is not explicitly stated beyond the fixed version; therefore, confirm with the vendor advisory before deployment.