CVE-2026-1106
📋 TL;DR
This vulnerability in Chamilo LMS allows attackers to manipulate the userId parameter in the deleteLegal function, leading to improper authorization. Attackers can exploit this remotely to delete legal consent records without proper permissions. All Chamilo LMS installations up to version 2.0.0 Beta 1 are affected.
💻 Affected Systems
- Chamilo LMS
📦 What is this software?
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
Chamilo Lms by Chamilo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete legal consent records for any user, potentially violating data protection regulations and compromising user privacy controls.
Likely Case
Unauthorized deletion of legal consent records, disrupting compliance tracking and user preference management.
If Mitigated
Limited impact with proper access controls and monitoring in place, though authorization bypass remains possible.
🎯 Exploit Status
Exploit has been publicly released and requires some authentication but bypasses authorization checks
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version beyond 2.0.0 Beta 1 if available, or apply manual code fixes.
🔧 Temporary Workarounds
Disable Legal Consent Handler
allTemporarily disable the vulnerable Legal Consent Handler component
# Modify src/CoreBundle/Controller/SocialController.php to comment out or remove deleteLegal function
Implement Input Validation
allAdd proper authorization checks before processing userId parameter
# Add session validation and user permission checks in deleteLegal function
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious userId parameter manipulation
- Restrict network access to Chamilo LMS to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check Chamilo LMS version. If version is 2.0.0 Beta 1 or earlier, system is vulnerable.Check Version:
Check Chamilo configuration files or admin panel for version informationVerify Fix Applied:
Test deleteLegal function with unauthorized userId parameter to ensure proper authorization checks are in place.📡 Detection & Monitoring
Log Indicators:
- Multiple deleteLegal requests with different userId parameters from same source
- Unauthorized access attempts to legal consent functions
Network Indicators:
- HTTP POST requests to SocialController.php with manipulated userId parameters
SIEM Query:
source="web_server" AND uri="*SocialController*" AND (method="POST" OR params CONTAINS "userId")