CVE-2025-52469

Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.

• CWE-841

• https://github.com/chamilo/chamilo-lms/commit/39e0fa88a2ba5dd197e0d8ce7335730b666992a6Patch
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m5xj-5xf3-rqchExploit, Vendor Advisory

Published

Mar 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52462Cross-site scripting vulnerability exists in Active! mail 6 …6.1
• CVE-2025-52463Cross-site request forgery vulnerability exists in Active! m…3.1
• CVE-2025-52464Meshtastic is an open source mesh networking solution. In ve…8.3
• CVE-2025-52465GeoServer is an open source server that allows users to shar…7.2
• CVE-2025-52467pgai is a Python library that transforms PostgreSQL into a r…9.1
• CVE-2025-52468Chamilo is a learning management system. Prior to version 1.…6.1
• CVE-2025-5247A vulnerability, which was classified as critical, has been …7.3
• CVE-2025-52470Chamilo is a learning management system. Prior to version 1.…4.8
• CVE-2025-52471ESF-IDF is the Espressif Internet of Things (IOT) Developmen…9.8
• CVE-2025-52472XWiki Platform is a generic wiki platform offering runtime s…9.3
• CVE-2025-52473liboqs is a C-language cryptographic library that provides i…5.5
• CVE-2025-52474WeGIA is a web manager for charitable institutions. Prior to…9.8