A logic vulnerability in Chamilo learning management system version prior to 1.11.30 allows authenticated users to bypass the friend request workflow in the social network module. Attackers can forcibly add any user as a friend by directly calling AJAX endpoints, circumventing normal approval processes. The vulnerability breaks access control mechanisms and can even allow addition of non-existent users. This creates privacy implications and undermines social interaction security. The issue has been patched in version 1.11.30.