CVE-2026-39878

Chamilo stored XSS via user registration leads to admin account takeover

9.3 Critical

CVE-2026-39878 is a critical vulnerability (CVSS 9.3) in Chamilo Chamilo-lms, published July 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.43%Up 0.2 points since Jul 21, 2026

What each source reports

CVE List Score used 9.3

Chamilo stored XSS via user registration leads to admin account takeover

Record: CVE-2026-39878
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2026-46038 9.3

Record: EUVD-2026-46038
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated: 2026-11-02

NVD 9.3

Record: CVE-2026-39878
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 9.3