CVE-2025-66581Medium· 6.5▾ SunlitFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned ro…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. This vulnerability is fixed in 2.41.0.
learning < 2.41.0Upgrade past the affected range:
learning 2.41.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109376Medium· 4.3ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets
CVE-2025-11283Low· 2.4A vulnerability was determined in Frappe LMS 2.35.0
CVE-2025-11282Low· 2.4A vulnerability was found in Frappe LMS 2.34.x/2.35.0
CVE-2025-11280Low· 3.7A flaw has been found in Frappe LMS 2.35.0
CVE-2025-62158Medium· 5.3Frappe Learning is a learning system that helps users structure their content
CVE-2025-62778Medium· 5.3Frappe Learning is a learning management system