Chamilo LMS is an open‑source learning management system. An insecure direct object reference was discovered in the PUT /api/users/{id} endpoint, allowing any authenticated user who has the ROLE_STUDENT privilege to modify their own user record. By changing the roles field to include ROLE_ADMIN, the attacker can elevate privileges to full administrative control. This grants access to all courses, user data, grade information and administrative settings, effectively compromising the entire platform.

The vulnerability affects all installations of Chamilo LMS using versions before 2.0.0‑RC.3 that expose the user API. The affected product is Chamilo LMS provided by the Chamilo project. Administrators should identify deployments running a pre‑RC.3 release and verify that the API is exposed.

The assigned CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated student account that has network connectivity to the API; the attacker needs only to craft a PUT request to their own user ID and assign the ADMIN role. Because the API's security expression only checks record ownership, further defensive checks are not performed, making exploitation straightforward for any logged‑in user. Immediate patching is strongly recommended.