CVE-2025-52469 - Vulnerability Analysis

Overview

Chamilo < 1.11.30 contains a broken access control vulnerability caused by improper validation in the friend request workflow of the social network module, letting authenticated users forcibly add any user as a friend, exploit requires authentication.

Severity & Score

Impact

Authenticated users can bypass friend request flow to add any user, potentially violating privacy and social interaction logic.

Mitigation

Update to version 1.11.30 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m5xj-5xf3-rqch
• https://github.com/chamilo/chamilo-lms/commit/39e0fa88a2ba5dd197e0d8ce7335730b666992a6

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner