A sensitive information disclosure vulnerability in Chamilo LMS 1.11.2 poses a significant privacy risk to users sharing devices on public or multi-user systems.

This is an improper cache control vulnerability located in the personal_data endpoint. It allows an unauthenticated, local attacker with physical access to a previously used device to retrieve sensitive user information after the legitimate user has logged out.

The exposure of sensitive user data presents a severe privacy and compliance risk, potentially leading to identity theft, account impersonation, or targeted phishing attacks. While the CVSS score of 7.5 reflects a high severity level, the impact is localized to environments where devices are shared among multiple users, such as shared workstations or public terminals.

Immediate Action: Since a specific patch is not yet identified, administrators should implement strict session management policies and advise users to clear browser caches after logging out of the platform.

Proactive Monitoring: Review web server and application logs for irregular access patterns to the personal_data endpoint and monitor for any reports of unauthorized account activity.

Compensating Controls: Configure browser security headers, such as Cache-Control: no-store, no-cache, must-revalidate, at the web server level to force browsers to discard sensitive session data upon logout.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository Rivek619/CVE-2025-69581.

Given the availability of a public proof-of-concept, this vulnerability should be treated with urgency in environments utilizing shared hardware. Organizations should prioritize user awareness training regarding browser cache management and investigate server-side configuration changes to enforce secure caching policies while awaiting an official vendor update.