VYPR
← All advisories
Medium severity5.5OSV Advisory· Published Jan 16, 2026· Updated Jun 17, 2026

CVE-2025-69581

CVE-2025-69581

Description

An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Chamilo/Lms3 versions
    cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:*
    • (no CPE)range: <=1.11.2
    • (no CPE)range: CHAMILO_1_8_7_ALPHA_1, CHAMILO_1_8_7_ALPHA_2, CHAMILO_1_8_7_RC2, …

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.