CVE-2026-33707

The password reset mechanism in Chamilo LMS creates a token based solely on the user's email address using the sha1() function, without adding a random component (such as salt or timestamp). The token has no expiration date or usage attempt limit. An attacker, knowing the victim's email address, can independently calculate the token value and directly invoke a password change request without interaction with the account owner.

An attacker can compromise any user account on the platform without authentication by resetting the password, leading to violation of data confidentiality and integrity. In the case of administrative accounts, the consequence may be complete compromise of the entire Chamilo LMS instance.

Update Chamilo LMS to version 1.11.38 or newer (1.x branch) or to version 2.0.0-RC.3 or newer (2.x branch). Patches are available in the official GitHub repository of the project (commits 078d7e5b and 750a4531). Until an update is applied, it is recommended to monitor logs for unauthorized password reset requests and consider temporarily disabling the self-service password reset functionality.

Chamilo LMS in versions prior to 1.11.38 (1.x branch) and prior to 2.0.0-RC.3 (2.x branch).