External risk intelligence

Chamilo LMS Stored XSS in Registration Form Allows Admin Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-39878

The vulnerability affects a Learning Management System (LMS) registration form. LMS platforms are typically deployed as public-facing web applications to allow users to register and access educational content, making the registration interface a common and intended point of internet-facing exposure.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Chamilo Learning Management System allows unauthenticated attackers to execute malicious code in an administrator's browser, potentially leading to full account takeover. This issue, found in the user registration form, means an attacker could gain complete control over the platform's administrative functions.

Unauthenticated users can control admin accounts.
Critical for protecting administrative access.
Confirm relevance and assess platform exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting malicious JavaScript through the user registration form. When an administrator views the registration details, the script executes within their browser, potentially leading to unauthorized control of the platform.

No authentication required to start.
Submitting malicious script in registration.
Full admin account takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser when they interact with the user registration form. This could lead to the takeover of an administrator account, potentially impacting the entire Chamilo LMS platform.

Administrator account takeover.
Malicious script executed via registration form.
Full platform administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this critical stored cross-site scripting vulnerability in Chamilo LMS, the platform or application owner is likely responsible for immediate triage, as they manage the Chamilo instance and its user registration process. The first practical move is to identify all Chamilo LMS deployments, confirm their internet reachability and business criticality, and then identify the specific accountable owner before planning remediation.

Platform or application owners should lead.
Verify internet-facing registration forms.
Plan vendor-coordinated updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chamilo LMS?

Chamilo LMS is an open-source learning management system designed to support educational initiatives and online courses. It provides a digital environment where organizations manage user registrations, content delivery, and pedagogical activities. Because it facilitates broad access for students and instructors, it functions as a centralized platform for managing academic and training interactions.

What does CVE-2026-39878 mean?

This vulnerability is classified as Stored Cross-Site Scripting (CWE-79). In plain terms, it means the software does not properly sanitize data entered into the user registration form. An attacker can store malicious JavaScript code in the system; when an administrator later views the registration data, that code runs automatically in the administrator's browser, potentially giving the attacker full control over the platform.

How is this vulnerability triggered?

An attacker triggers this by submitting a registration form containing malicious script content. Because the registration form is designed to be accessible to potential new users, no prior authentication is required to inject the payload. Simply visiting a registration page that does not require an existing account is enough to attempt this action; the code is only executed when an administrator subsequently interacts with the compromised registration record.

Is my Chamilo LMS installation at risk?

According to Halo Surface Signal, risk is high because Chamilo LMS is typically deployed as a public-facing web application. Since the vulnerable component is the registration form—a feature meant to be accessible to the internet—any instance allowing public registration is likely reachable by external actors. Installations restricted to internal-only networks may have different risk profiles, but public-facing instances are the primary concern.

What is the first step to address this?

The immediate priority is to locate all active Chamilo LMS instances within your environment and determine if they are exposed to the internet. Verify the software version currently in use; since this issue was resolved in version 1.11.40, any system running 1.11.38 or earlier requires an update. Once you have identified all affected deployments, coordinate with the system owners to apply the necessary security updates provided by the vendor.

References

github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7j…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.