Back www.thehackerwire.com

CVE-2026-33707 TheHackerWire / 18h Attack Vector How the vulnerability can be exploited Network Scope Impact beyond vulnerable component Unchanged

www.thehackerwire.com • April 11, 2026

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Modify values to recalculate the CVSS score in real-time

0.07% probability of exploitation in the 30 days.

Higher than 20% of all CVEs

Stay informed the most severe security threats discovered this week

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability CVE-2026-33707 in Chamilo LMS Allows Account Takeover CVE-2026-33707 is a critical vulnerability affecting Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3. The flaw arises from a weak password reset mechanism that generates predictable tokens using sha1($email) without randomization, expiration, or rate limiting. An unauthenticated attacker can exploit this vulnerability by knowing a user's email, allowing them to compute the reset token and take over user accounts. The impact includes unauthorized access to sensitive learning data, course content modification, and user impersonation. Although patches are available for the affected versions, there is currently no evidence of exploitation in the wild or public proof-of-concept. Organizations are advised to upgrade their Chamilo LMS installations immediately and monitor account access logs for suspicious activities. The CVSS base score assigned to this vulnerability is 9.4, indicating a high severity level. 2 sources 71

Extracted Entities

CVEs (1)

CVE-2026-33707

Platforms (1)

Chamilo LMS