{"id":"CVE-2026-45141","aliases":[],"cve":{"records":[{"id":"CVE-2026-45141","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-08T20:44:38.963Z","published":"2026-10-30T14:30:44.438Z","modified":"2026-10-30T15:46:07.156Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T14:30:44.438Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T15:46:07.156Z"}],"references":[{"url":"https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p2qq-wjp2-j334","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/chamilo/chamilo-lms/commit/6c9586034284fb7773056c79055798298fbc6d3d","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-352","description":"CWE-352: Cross-Site Request Forgery (CSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:45:50.594640Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Chamilo LMS: CSRF in destructive skill-management AJAX actions","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token()` validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.","score":6.5,"severity":"medium","published":"2026-10-30T14:30:44.438Z","modified":"2026-10-30T15:46:07.156Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"chamilo","name":"chamilo-lms","platforms":[],"versions":[{"version":"< 2.0.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-45141"}],"remediation":[],"references":["https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-p2qq-wjp2-j334","https://github.com/chamilo/chamilo-lms/commit/6c9586034284fb7773056c79055798298fbc6d3d","https://github.com/chamilo/chamilo-lms/releases/tag/v2.0.1"],"sources":[{"name":"CVE","id":"CVE-2026-45141","modified":"2026-10-30T15:46:07.156Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-45141"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T16:16:33.429Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:05:32.990Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T16:30:34.801Z","attemptedAt":"2026-10-30T16:30:34.801Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T16:30:35.591Z","attemptedAt":"2026-10-30T16:30:35.591Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T16:30:35.114Z","attemptedAt":"2026-10-30T16:30:35.114Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T16:30:34.805Z","attemptedAt":"2026-10-30T16:30:34.805Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-45141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45141","modified":"2026-10-30T16:17:56.053","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T16:30:34.801Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113998","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113998","modified":"Oct 30, 2026, 2:30:44 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T16:30:35.114Z"}],"aiSummary":null}