A logic flaw in the Chamilo LMS social network module allows authenticated users to forcibly add other users as friends, bypassing standard access control workflows.

This vulnerability involves an improper enforcement of behavioral workflow (CWE-841) within the social network module. An authenticated attacker can manipulate the friend request process by directly calling the AJAX endpoint, effectively bypassing the requirement for mutual acceptance.

The exploitation of this vulnerability leads to broken access control and unauthorized social manipulation within the learning management system. Given the CVSS score of 7.1, this is considered a high-severity issue because it facilitates unauthorized data exposure and potential privacy violations for all users within the platform.

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to apply the necessary logic checks in the friend request workflow.

Proactive Monitoring: Review web server and application logs for suspicious or high-frequency calls to AJAX endpoints related to user social interactions or friend requests.

Compensating Controls: Implement WAF rules to restrict access to the social network AJAX endpoints if immediate patching is not possible, though this may impact legitimate social functionality.

Public Exploit Available: No

This vulnerability poses a significant risk to user privacy and system integrity by allowing unauthorized modifications to social relationships. Administrators must prioritize upgrading to version 1.11.30 immediately to remediate the broken workflow logic and prevent potential misuse by malicious actors.