CVE-2026-34370 is an improper authorization vulnerability (CWE-285) in Chamilo LMS's notebook module affecting versions before 2.0.0-RC.3. The vulnerability arises because the read path (get_note_information()) does not verify that the requesting user owns the note identified by the notebook_id parameter, enabling authenticated students to read other users' private notes. While write operations enforce ownership checks, the read operation lacks this validation, leading to unauthorized data disclosure. The issue is resolved in version 2.0.0-RC.3.

An authenticated user can read private course notes belonging to other users without authorization. This results in unauthorized disclosure of potentially sensitive note content, impacting confidentiality. There is no impact on integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where this vulnerability is fixed. Patch status is not explicitly stated beyond the fix in 2.0.0-RC.3, so verify with the vendor advisory for the latest remediation guidance. Until upgraded, restrict access to the notebook module to trusted users and monitor for unauthorized access attempts if possible.