Cyber Posture

CVE-2026-33707

Critical

Published: 10 April 2026

Published
10 April 2026
Modified
16 April 2026
KEV Added
Patch
CVSS Score 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0011 29.2th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute…

more

the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Mitigating Controls (NIST 800-53 r5)AI

prevent

IA-5 mandates secure authenticator management with sufficient strength of mechanism, expiration/refresh procedures, and protections against compromise, directly countering the predictable, non-expiring sha1($email) reset tokens.

prevent

SI-2 requires timely remediation of software flaws, ensuring patches like those in Chamilo 1.11.38/2.0.0-RC.3 are identified, tested, and applied to fix the weak password reset mechanism.

prevent

AC-7 enforces rate limiting and lockouts on authentication-related attempts, addressing the absence of rate limiting on password reset requests that was part of the vulnerability and fix.

Security SummaryAI

CVE-2026-33707 affects Chamilo LMS, an open-source learning management system, in versions prior to 1.11.38 and 2.0.0-RC.3. The vulnerability lies in the default password reset mechanism, which generates reset tokens using a deterministic SHA1 hash of the user's email address (sha1($email)) without any random component, expiration time, or rate limiting. This makes the tokens fully predictable for anyone who knows the target email, enabling unauthorized password changes. The issue is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) with a CVSS v3.1 base score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating critical severity due to high impacts on confidentiality and integrity.

Any unauthenticated attacker with knowledge of a victim's email address—which is often publicly exposed or guessable—can exploit this over the network with low complexity and no user interaction required. By computing the exact reset token, the attacker can initiate a password reset request and immediately use the token to set a new password for the victim account, gaining full unauthorized access to the user's profile, courses, and potentially administrative functions depending on the victim's privileges.

The vulnerability is addressed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3 through commits that improve token generation with randomness, expiration, and rate limiting, as detailed in the GitHub security advisory (GHSA-f27g-66gq-g7v2) and specific patches (commits 078d7e5b77679fa7ccfcd6783bd5cc683db0bda8 and 750a45312a0d5c3ad60dbfbd0d959ca40be4a18c). Security practitioners should upgrade affected instances immediately and review email exposure in their deployments.

Details

CWE(s)

Affected Products

chamilo
chamilo lms
2.0.0 · ≤ 1.11.38

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Why these techniques?

The vulnerability is a flaw in a public-facing web application (Chamilo LMS) that allows remote unauthenticated exploitation to predict and use password reset tokens, directly enabling T1190 (Exploit Public-Facing Application) for initial access and facilitating T1078 (Valid Accounts) by granting unauthorized control over existing user accounts.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References