Chamilo LMS contains an insecure direct object reference that allows any authenticated student to read the private course notes of other users by manipulating the notebook_id parameter in the editnote action. The system retrieves note information using only the provided integer ID without checking that the requesting user owns the note, returning the full title and HTML body in the edit form. This grants the attacker full access to the note contents, exposing potentially sensitive academic data.

The vulnerability applies to Chamilo LMS releases preceding 2.0.0‑RC.3. The fix, which adds the necessary ownership checks to the read path, is available in that release. The product is distributed under the chamilo‑lms code base by chamilo.

With a CVSS score of 6.5 the flaw is considered moderate, but it permits the leakage of confidential course notes. Exploitation requires only that the attacker be a logged‑in user, and no privileged escalation is needed. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, indicating no public exploits are known. Nevertheless, the ability to read arbitrary private notes constitutes a significant privacy risk that should be addressed promptly.