The vulnerability arises from missing authorization checks in legacy AJAX handlers within Chamilo LMS, specifically those in the public/main/inc/ajax/ directory. This flaw allows unauthenticated or low‑privileged users to invoke actions such as get_users_by_group_course, user_by_all_roles, and export_all_certificates, thereby harvesting usernames and downloadable certificate PDFs. The result is a clear breach of confidentiality, exposing personal and academic credentials to anyone who can reach these endpoints.

Chamilo LMS versions from 2.0.0-alpha.1 up to, but not including, 2.0.0‑RC.3 are affected. The product is maintained by the Chamilo community and is identified by the CPE cpe:2.3:a:chamilo:chamilo_lms.* The vulnerability is present in the legacy AJAX endpoints before the release of RC.3, which contains the patch that restores proper authorization checks.

The CVSS score of 6.9 indicates a moderate level of risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not widely exploited in the wild. The likely attack vector is HTTP requests to the exposed AJAX endpoints, which require no authentication or only low‑privilege credentials. An attacker can construct or use automated tools to trigger these endpoints and download sensitive user data.