CVE-2026-61805Medium· 5.3▾ SunlitFrappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticate…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
lms < 2.54.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61806Medium· 5.3Frappe LMS allows unpublished certificate access
CVE-2026-39375Medium· 5.1Frappe LMS has Stored XSS in Course Meta
CVE-2026-61803Medium· 5.3Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
CVE-2026-111938Medium· 4.3Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log