Chamilo LMS is vulnerable to user enumeration through its response handling. An attacker can determine whether a username exists by sending a request with a candidate username and observing the system’s response. This flaw is classified as CWE‑204 and allows an attacker to gather valid usernames, which can facilitate credential stuffing, phishing, or targeted attacks. The vulnerability does not provide remote code execution or direct access to privileged data, but it does expose user identity information.

The issue affects the Chamilo Learning Management System (Chamilo‑LMS). Versions prior to 1.11.36 are impacted; the vulnerability is fixed in release 1.11.36 and later.

The CVSS score is 6.3, indicating medium severity, and the EPSS score is below 1%, suggesting low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation can occur remotely via the web interface, requiring only access to the LMS endpoint and valid usernames for enumeration. The risk is elevated for environments that rely on strict user identity confidentiality but is mitigated by the low likelihood of widespread exploitation.