CVE-2026-33736

Chamilo LMS versions prior to 2.0.0-RC.3 contain an information disclosure vulnerability (CVE-2026-33736) that allows any authenticated user, including those with student-level privileges, to enumerate all platform users and retrieve sensitive personal information such as email addresses, phone numbers, and assigned roles through the GET /api/users endpoint. This exposure extends to administrator accounts and represents a significant privacy breach within educational institutions using affected versions. The vulnerability requires network access and valid authentication credentials but no user interaction, making it exploitable by any logged-in user with minimal effort. The CVSS score of 6.5 MEDIUM reflects the high confidentiality impact balanced against the requirement for prior authentication. There is currently no evidence of active exploitation in the wild, with no known public exploit code available and minimal community attention, though the vulnerability should be remediated promptly by upgrading to version 2.0.0-RC.3 or later.