Chamilo LMS versions prior to 2.0.0‑RC.3 contain an Insecure Direct Object Reference flaw in the /api/course_rel_users endpoint. The vulnerability allows an authenticated attacker to change the user parameter in the request payload, enrolling any user into any course without verification that the requester is authorized to act on behalf of that user. This defect removes the protective boundaries of enrollment controls, enabling the attacker to view and interact with course materials that were not intended for them, potentially exposing sensitive educational content and undermining the integrity of the platform.

The affected product is Chamilo LMS. All installations running a version older than 2.0.0‑RC.3 are vulnerable. Versions 2.0.0‑RC.3 and newer include the fix confirmed in the linked commits and release notes.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The CVE description states that the attacker must be authenticated to use the endpoint, but it does not explicitly require privileged roles; it is inferred that a normal authenticated user can exploit the flaw. The attack vector is likely a network request to the API; this is also inferred because the description references the /api/course_rel_users endpoint. The absence of server‑side checks for ownership or permission markedly increases the potential impact, and the vulnerability is not listed in the CISA KEV catalog.