EIP-2026-105811

This is a writeup describing an Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS, where an attacker can delete other users' social wall posts by manipulating the 'messageId' parameter. The vulnerability is exploited via a GET request to 'social/profile.php'.