Chamilo LMS suffers an open redirect flaw in the session course edit page that accepts an unvalidated 'page' parameter. When an authenticated administrator saves changes to coach assignments, the system redirects the browser to the supplied URL. The redirect also transmits the session identifier to the target domain. This can facilitate phishing attacks and unauthorized tracking of administrative sessions.

Versions of Chamilo LMS before 1.11.38 and before 2.0.0‑RC.3 are affected. The risk applies to any installation of Chamilo LMS where standard user credentialing and course management functionality are in use, especially for users with administrative privileges to edit coach assignments.

The CVSS score of 4.7 indicates moderate severity. Exploitation requires authenticated access as an administrator and the ability to modify coach assignment data, making it less likely to be widely abused by unauthenticated attackers. Without the EPSS score and KEV listing, the likelihood of exploitation remains uncertain, though the presence of a session‑id leak adds additional potential for credential compromise. The primary attack vector is user interaction with the redirect after an admin action, making it a social‑engineered risk rather than a purely automated exploit.