CVE-2026-31940 | THREATINT

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

PUBLISHED Reserved 2026-03-10 | Published 2026-04-10 | Updated 2026-04-14 | Assigner GitHub_M

HIGH: 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-384: Session Fixation

Product status

< 1.11.38

affected

>= 2.0.0-alpha.1, < 2.0.0-RC.3

affected

References

github.com/...lo-lms/security/advisories/GHSA-4gp7-cfjh-77gv

github.com/...ommit/ce0192c62e48c9d9474d915c541b3274844afbf9

github.com/...ommit/e337b7cc74a0276a0b4f91f9282204d20cac1869

cve.org (CVE-2026-31940)

nvd.nist.gov (CVE-2026-31940)

Download JSON