Medium severity6.5NVD Advisory· Published Apr 10, 2026· Updated Apr 16, 2026
CVE-2026-33708
CVE-2026-33708
Description
Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerability is fixed in 1.11.38.
Affected products
1Patches
14a119f93abbfhttps://github.com/chamilo/chamilo-lmsvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.