CVE-2026-61806
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.
Risk Assessment
An unauthorized user may gain insight into other users' certificate data, constituting a confidentiality breach. This could lead to leakage of personal or business information.
Recommendation
Update Frappe LMS to version 2.54.2 or later to fix the authorization flaw for unpublished certificates.
Other vulnerabilities in Frappe Learning Management System (LMS)
See all- CVE-2026-61805Medium
In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.
- CVE-2026-61803Medium
In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.
- CVE-2026-39375Medium
In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.
- CVE-2026-54343High
In Frappe Learning Management System (LMS) prior to 2.52.1, SCORMRenderer.render in lms/page_renderers.py constructs and opens a server-side path without confirming its real path remains within public/scorm. A remote attacker can read files outside the SCORM directory.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS