CVE-2026-40291 is an improper privilege management vulnerability (CWE-269) in chamilo-lms versions before 2.0.0-RC.3. The PUT /api/users/{id} endpoint allows authenticated users with the ROLE_STUDENT to escalate privileges to ROLE_ADMIN by modifying the roles field on their user record. The API Platform security expression only verifies ownership (is_granted('EDIT', object)) but does not restrict modification of the roles field, which is included in the writable serialization group. This flaw enables any student user to assign themselves administrative roles, resulting in full platform control. The issue is resolved in version 2.0.0-RC.3.

Successful exploitation allows a low-privileged authenticated user (ROLE_STUDENT) to gain full administrative privileges (ROLE_ADMIN). This grants complete control over the Chamilo LMS platform, including access to all courses, user data, grades, and administrative settings. The vulnerability poses a high risk to confidentiality, integrity, and availability of the system.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, where this vulnerability is fixed. Patch status is not explicitly stated beyond the fixed version, so verify with the vendor advisory for the latest remediation guidance. Until upgraded, restrict access to the API endpoint and review user role assignment processes to prevent unauthorized role modifications.