CVE-2026-31940

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

• CWE-384

• https://github.com/chamilo/chamilo-lms/commit/ce0192c62e48c9d9474d915c541b3274844afbf9Patch
• https://github.com/chamilo/chamilo-lms/commit/e337b7cc74a0276a0b4f91f9282204d20cac1869Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4gp7-cfjh-77gvVendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31934Suricata is a network IDS, IPS and NSM engine. From version …7.5
• CVE-2026-31935Suricata is a network IDS, IPS and NSM engine. Prior to vers…7.5
• CVE-2026-31937Suricata is a network IDS, IPS and NSM engine. Prior to vers…7.5
• CVE-2026-31938jsPDF is a library to generate PDFs in JavaScript. Prior to …6.1
• CVE-2026-31939Chamilo LMS is a learning management system. Prior to 1.11.3…8.3
• CVE-2026-3194A flaw has been found in Chia Blockchain 2.1.0. The affected…7
• CVE-2026-31941Chamilo LMS is a learning management system. Prior to 1.11.3…6.5
• CVE-2026-31942LibreChat is an enhanced ChatGPT clone that supports multipl…7.1
• CVE-2026-31943LibreChat is a ChatGPT clone with additional features. Prior…8.5
• CVE-2026-31944LibreChat is a ChatGPT clone with additional features. From …7.6
• CVE-2026-31945LibreChat is a ChatGPT clone with additional features. Versi…7.7
• CVE-2026-31946OpenOlat is an open source web-based e-learning platform for…9.8