Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in a…

published 2019-02-04 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-1736

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 0; none known

Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.

Patch / fix

links 2

Exploit prediction

0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness

CWE-862 Missing Authorization

References

github.com /chamilo/chamilo-lms/commit/33e2692a37b5b6340cf5bec1a84e541460983c03
patch, third-party-advisory
support.chamilo.org /projects/1/wiki/Security_issues#Issue-34-2019-01-14-Moderate-risk-moderate-impact-XSS-and-unauthorized-access
patch, vendor-advisory

Sources

CVE List CVE-2019-1000017
NVD CVE-2019-1000017

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary