Is CVE-2026-34602 actively exploited?

No active exploitation of CVE-2026-34602 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34602 be exploited remotely?

Yes. CVE-2026-34602 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34602?

CVE-2026-34602 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-34602

HIGH

CVE-2026-34602

CWE-639Published: April 14, 2026· Updated: Apr 17, 2026

7.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.0th

Official Description

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into any course without proper authorization checks. The backend trusts the user-supplied input for the user field and performs no server-side verification that the requester owns the referenced user ID or has permission to act on behalf of other users. This enables unauthorized manipulation of user-course relationships, potentially granting unintended access to course materials, bypassing enrollment controls, and compromising platform integrity. This issue has been fixed in version 2.0.0-RC.3.

NVD Source

Technical Analysis

CVE-2026-34602 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.1.