CVE-2026-33707

CRITICAL

Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

Title source: cna
STIX 2.1

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

References (3)

Core 3

Scores

CVSS v3 9.4
EPSS 0.0042
EPSS Percentile 33.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-640
Status published
Products (4)
chamilo/chamilo-lms < 1.11.38
chamilo/chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3
chamilo/chamilo_lms 2.0.0 alpha1 (10 CPE variants)
chamilo/chamilo_lms < 1.11.38
Published Apr 10, 2026
Tracked Since Apr 11, 2026