CVE-2026-61805
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.
Risk Assessment
Integrity compromise of quiz results may lead to unfair acquisition of certificates and course completion. Additionally, an attacker can block legitimate submissions of other users, causing availability issues.
Recommendation
Update Frappe LMS to version 2.54.0 or later to fix the quiz submission authorization flaw.
Other vulnerabilities in Frappe Learning Management System (LMS)
See all- CVE-2026-61806Medium
In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.
- CVE-2026-61803Medium
In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.
- CVE-2026-39375Medium
In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.
- CVE-2026-54343High
In Frappe Learning Management System (LMS) prior to 2.52.1, SCORMRenderer.render in lms/page_renderers.py constructs and opens a server-side path without confirming its real path remains within public/scorm. A remote attacker can read files outside the SCORM directory.
Original NVD description (English source)
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS