Chamilo Learning Management System fails to enforce authorization on its get_user_info_from_username REST API, allowing any authenticated user to retrieve sensitive personal details—such as email addresses, first and last names, user IDs, and account status—of any other user, including students. This constitutes a confidentiality breach, exposing personally identifying information and thereby violating privacy requirements.

All Chamilo LMS installations running a version earlier than 1.11.38 are affected. Users of these earlier versions, regardless of their role within the system, can exploit the vulnerability to access the personal data of other users.

The vulnerability is rated at a moderate severity score of 6.5. Since the exploit requires only authentication to the LMS, the likelihood of exploitation is high in environments where many users have legitimate access. The actionable exploit vector appears to be any authenticated web request to the exposed API endpoint. The vulnerability is not cataloged as a known exploited vulnerability by the relevant national security agency, and public data on exploit probability is unavailable.