CVE-2026-33707

Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 contain a critical authentication bypass vulnerability in the password reset mechanism. The flaw stems from the use of a predictable token generation method—SHA1 hashing of the user's email address—that lacks randomization, expiration, and rate limiting controls. This allows attackers to compute valid reset tokens for any known email address and gain unauthorized account access. The vulnerability carries a CVSS score of 9.8 (CRITICAL) with a network-based attack vector requiring no privileges or user interaction. An unauthenticated attacker can remotely exploit this flaw to achieve complete compromise of affected accounts, including confidentiality, integrity, and availability impacts. The straightforward nature of the attack—simple SHA1 hash computation—makes exploitation trivial for any threat actor with basic technical knowledge. Exploitation status indicates this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and there are no public indicators of active large-scale exploitation campaigns. However, the simplicity of the attack mechanism and the high severity rating warrant immediate patching. All organizations running affected Chamilo LMS versions should prioritize updating to the fixed versions 1.11.38 or 2.0.0-RC.3 or later to mitigate this high-risk exposure.