CVE-2026-61803
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.
Risk Assessment
A user can purchase paid content at a reduced price, causing financial losses for the organization. This may also undermine trust in the payment system.
Recommendation
Update Frappe LMS to version 2.52.1 or later to fix the pricing logic flaw in checkout.
Other vulnerabilities in Frappe Learning Management System (LMS)
See all- CVE-2026-61806Medium
In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.
- CVE-2026-61805Medium
In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.
- CVE-2026-39375Medium
In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.
- CVE-2026-54343High
In Frappe Learning Management System (LMS) prior to 2.52.1, SCORMRenderer.render in lms/page_renderers.py constructs and opens a server-side path without confirming its real path remains within public/scorm. A remote attacker can read files outside the SCORM directory.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS