An authenticated user in Chamilo LMS can exploit an API vulnerability to escalate their privileges to Teacher or Course Manager, posing a significant risk to institutional data integrity.

This is a privilege escalation flaw (CWE-269) occurring in the update_user_from_username REST API endpoint, where any authenticated user possessing a valid API key can modify their status field. An attacker with standard student privileges can elevate their account to instructor levels, gaining unauthorized access to administrative functions.

The ability for a regular user to escalate privileges to a management role compromises the integrity of the learning environment and allows for unauthorized course administration. Given the CVSS score of 7.1, this is a high-severity issue that could lead to the exposure of student records or the manipulation of academic content. Organizations relying on Chamilo for sensitive training or testing should prioritize this update to prevent unauthorized administrative control.

Immediate Action: Update Chamilo LMS to version 1.11.38 or later to incorporate the necessary privilege validation checks.

Proactive Monitoring: Review REST API access logs for unusual update_user_from_username requests, particularly those originating from accounts with student status.

Compensating Controls: Restrict access to the REST API via network-level controls or web application firewall rules if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability represents a critical failure in authorization logic that can be exploited by any standard user with API access. IT administrators must treat this as a high priority and apply the 1.11.38 update immediately to prevent unauthorized privilege escalation and potential systemic abuse.