VYPR
← All advisories
Medium severity5.5OSV Advisory· Published Jan 16, 2026· Updated Jun 17, 2026

CVE-2025-69581

CVE-2025-69581

Description

An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Chamilo/LmsOSV3 versions
    CHAMILO_1_8_7_ALPHA_1, CHAMILO_1_8_7_ALPHA_2, CHAMILO_1_8_7_RC2, …+ 2 more
    • (no CPE)range: CHAMILO_1_8_7_ALPHA_1, CHAMILO_1_8_7_ALPHA_2, CHAMILO_1_8_7_RC2, …
    • cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:*
    • (no CPE)range: <=1.11.2

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.