An authenticated user with a valid REST API key can change their own user status via the update_user_from_username endpoint. This flaw allows a user who originally has the student status (status=5) to elevate to the teacher or course manager role (status=1). The result is that the user gains the ability to create and manage courses, a privilege normally reserved for higher‑level accounts. The weakness corresponds to improper authorization controls (CWE‑269).

The vulnerability affects Chamilo Learning Management System from any release prior to version 1.11.38. Users of older versions using the REST API are at risk if they possess an API key, regardless of their original role.

The CVSS score of 7.1 indicates a high risk level. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely through an existing authenticated REST API key. Exploitation requires only the ability to send an API request, making it easily achievable by a compromised or brute‑forced account. Once exploited, the attacker gains full access to course creation and management, compromising the integrity and availability of the LMS. The risk is significant for any organization that relies on REST API access for administrative functions.