CVE-2026-33707
Published: 10 April 2026
Description
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute…
more
the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Mitigating Controls (NIST 800-53 r5)AI
IA-5 mandates secure authenticator management with sufficient strength of mechanism, expiration/refresh procedures, and protections against compromise, directly countering the predictable, non-expiring sha1($email) reset tokens.
SI-2 requires timely remediation of software flaws, ensuring patches like those in Chamilo 1.11.38/2.0.0-RC.3 are identified, tested, and applied to fix the weak password reset mechanism.
AC-7 enforces rate limiting and lockouts on authentication-related attempts, addressing the absence of rate limiting on password reset requests that was part of the vulnerability and fix.
Security SummaryAI
CVE-2026-33707 affects Chamilo LMS, an open-source learning management system, in versions prior to 1.11.38 and 2.0.0-RC.3. The vulnerability lies in the default password reset mechanism, which generates reset tokens using a deterministic SHA1 hash of the user's email address (sha1($email)) without any random component, expiration time, or rate limiting. This makes the tokens fully predictable for anyone who knows the target email, enabling unauthorized password changes. The issue is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) with a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating critical severity due to high impacts on confidentiality and integrity.
Any unauthenticated attacker with knowledge of a victim's email address—which is often publicly exposed or guessable—can exploit this over the network with low complexity and no user interaction required. By computing the exact reset token, the attacker can initiate a password reset request and immediately use the token to set a new password for the victim account, gaining full unauthorized access to the user's profile, courses, and potentially administrative functions depending on the victim's privileges.
The vulnerability is addressed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3 through commits that improve token generation with randomness, expiration, and rate limiting, as detailed in the GitHub security advisory (GHSA-f27g-66gq-g7v2) and specific patches (commits 078d7e5b77679fa7ccfcd6783bd5cc683db0bda8 and 750a45312a0d5c3ad60dbfbd0d959ca40be4a18c). Security practitioners should upgrade affected instances immediately and review email exposure in their deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a flaw in a public-facing web application (Chamilo LMS) that allows remote unauthenticated exploitation to predict and use password reset tokens, directly enabling T1190 (Exploit Public-Facing Application) for initial access and facilitating T1078 (Valid Accounts) by granting unauthorized control over existing user accounts.