CVE-2026-33707 is a critical-severity vulnerability. AttackerView checks Chamilo sites for it with a live exploit check.
Detects Chamilo LMS instances before 1.11.38 where the password reset mechanism generates tokens using sha1(email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication, leading to full account takeover. Update to Chamilo 1.11.38 or 2.0.0-RC.3.
Is your app exploitable through CVE-2026-33707?
Scan your domain free