CVE-2026-34370 is an improper authorization vulnerability (CWE-285) in Chamilo LMS's notebook module affecting versions prior to 2.0.0-RC.3. The vulnerability is an IDOR that allows authenticated students to access private notes of other users by altering the notebook_id parameter during the editnote action. The read function (get_note_information()) lacks ownership verification, exposing note content including titles and HTML bodies. Write operations enforce ownership checks, but read operations do not, leading to unauthorized data disclosure. The vulnerability is addressed in Chamilo LMS version 2.0.0-RC.3.

An attacker with valid student credentials can access private course notes of other users without authorization, leading to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability but compromises confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges of an authenticated user, no user interaction, and high confidentiality impact.

This vulnerability is fixed in Chamilo LMS version 2.0.0-RC.3. Users and administrators should upgrade to version 2.0.0-RC.3 or later to remediate the issue. No official patch or temporary fix details are provided beyond the version update. Until upgrading, restrict access to trusted users and monitor for unauthorized access attempts to notebook data. Patch status is not explicitly confirmed beyond the stated fixed version; verify with the vendor advisory for current remediation guidance.