CVE-2026-33707 is a weak password recovery flaw in Chamilo LMS. NVD scores it 9.4. The default reset token is derived from the user's email address alone, so anyone who knows an email can compute it. Upgrade to 1.11.38 or 2.0.0-RC.3.
What's affected
The advisory lists affected versions as 1.11.36 and below and 2.0-RC.2, with patched versions 1.11.38 and 2.0-RC.3. The NVD record says prior to 1.11.38 and 2.0.0-RC.3. The advisory says the vulnerable path is the default, active when the user_reset_password setting is false, which is its installed default.
How to check if you're exposed
Check your Chamilo version against the fixed releases. Then look at the user_reset_password setting in your configuration. The advisory says the weak path is active when it is false.
Review your web server logs for requests to the lost password page that carry a reset parameter you cannot tie to a user request, and check for password changes at unusual times.
What to do now
- Upgrade to Chamilo 1.11.38, or 2.0.0-RC.3 on the 2.x line.
- Review accounts with administrative or teacher rights first, and look for recent password changes you cannot explain.
- Force a password reset for high privilege accounts after upgrading.
- Limit exposure of user email addresses through any API or profile page, since the advisory says an email address is the one input the attacker needs.
Why it matters
The record maps to CWE-640, weak password recovery mechanism for forgotten password. The advisory says the token was the SHA-1 hash of the email, with no random value, no expiry and no rate limiting. A hash of something public is not a secret.
A reset token should be random, single use, short lived and tied to a request. The same weakness appears whenever a team builds recovery from convenient data. The record is not marked as exploited in the wild and is not in CISA KEV.
Quick check
Why is a hashed email a bad token?
Anyone who knows the email can compute the same hash, so the token proves nothing.
Sources
Last reviewed: 19 October 2026.
