A critical privilege escalation vulnerability in Chamilo LMS allows any authenticated student to elevate their account to administrative status, posing a severe risk to platform integrity.

The flaw exists in the PUT /api/users/{id} endpoint where improper authorization checks allow authenticated users to modify their own user record. Because the roles field is included in the writable serialization group, an attacker can escalate their privileges to ROLE_ADMIN.

Successful exploitation grants an attacker full administrative control over the learning management system. This results in unauthorized access to sensitive student data, grades, course materials, and administrative configurations, which can lead to significant reputational damage and data privacy breaches. Given the CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent total system compromise.

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to ensure the roles field is correctly restricted and authorization checks are properly enforced.

Proactive Monitoring: Review access logs for the /api/users/ endpoint, specifically looking for unusual PUT requests or attempts by non-administrative users to modify account roles.

Compensating Controls: Implement strict API gateway policies to restrict access to the /api/users/{id} endpoint and utilize a Web Application Firewall to block unauthorized attempts to modify sensitive user profile fields.

Public Exploit Available: false

The ability for a standard student user to gain administrative privileges via a simple API request represents a critical security failure. Administrators must prioritize updating the Chamilo LMS instance to version 2.0.0-RC.3 immediately. Failure to patch this vulnerability leaves the entire educational environment open to full unauthorized administrative takeover.