CVE-2025-69581

5.5 mediumEPSS 0.2%

Medium (5.5) in chamilo chamilo lms. EPSS 0.2% chance of exploitation in the next 30 days.

An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the same device to view confidential information. This leads to profiling, impersonation, targeted attacks, and significant privacy risks.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-524
Published: 2026-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

chamilo:chamilo_lms

References

https://github.com/Rivek619/CVE-2025-69581
https://github.com/chamilo/chamilo-lms

Check your stack JSON