Chamilo LMS allows an authenticated user to alter another user’s learning path progress data such as score, status, completion, and time. This occurs because the progress‑saving endpoint accepts a user ID from the request and applies changes to that ID without validation, exposing an insecure direct object reference. The flaw can lead to deceptive records, misrepresenting a learner’s achievements.

The vulnerability is present in Chamilo LMS versions prior to 1.11.38 and 2.0.0‑RC.3. Any deployment running an older main branch may be affected; this includes enterprise installations and community builds below those release thresholds.

With a CVSS score of 7.1, the risk is considered high. An attacker only needs to be authenticated and enrolled in a course, then modify the uid parameter in an HTTP request to overwrite another user’s progress. Because the exploit does not require elevated privileges or external setup, the attack vector is straightforward, making exploitation likely. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but its moderate severity and straightforward exploitation path warrant immediate attention.