CVE-2025-11281 Details
Description
A vulnerability has been found in Frappe LMS 2.35.0. The affected element is an unknown function of the file /courses/ of the component Unpublished Course Handler. Such manipulation leads to improper access controls. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. You should upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
An access control vulnerability has been identified in Frappe LMS version 2.35.0, allowing unauthorized users to view unpublished courses. While the platform's documentation states that courses should remain hidden until published, unpublished courses can still be accessed directly via their URLs. This flaw not only exposes course metadata to unauthenticated users but also allows authenticated users with the 'LMS Student' role to access full course content and submit assignments, regardless of the course's publication status.
It is recommended to implement strict access controls for unpublished courses, ensuring that all course content and metadata are completely inaccessible until the 'Published' flag is activated. Access permissions should be validated at the controller level, rather than relying solely on user interface display logic.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 7, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89 | CISA-ADP | ExploitThird Party Advisory |
| https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89#steps-to-reproduce | CISA-ADP | ExploitThird Party Advisory |
| https://vuldb.com/?submit.659695 | CISA-ADP | ExploitThird Party AdvisoryVDB Entry |
| https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89 | [email protected] | ExploitThird Party Advisory |
| https://gist.github.com/0xHamy/5ebd820ad30f33827011e9a614fb2f89#steps-to-reproduce | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.327015 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.327015 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.659695 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frappe learning | 2.35.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Oct 7, 2025 | Initial Analysis | [email protected] |
| Oct 7, 2025 | CVE Modified | CISA-ADP |
| Oct 5, 2025 | New CVE Received | [email protected] |