CVE-2026-61803 Details
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
A business-logic vulnerability has been identified in Frappe Learning Management System (LMS) versions prior to 2.52.1. The issue arises in the course and certificate checkout process, where client-controlled pricing is accepted. This allows authenticated users to purchase courses or certificates for an amount different from the actual price. The vulnerability does not compromise the data of other users or provide elevated privileges.
Users can upgrade to Frappe LMS version 2.52.1 or later to address this vulnerability. In version 2.52.1, the checkout process was modified to ensure that pricing is determined solely by the server, eliminating the possibility of client-side manipulation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/lms/commit/1d04f4fd917b62f5dd4442a541280fc40a4178b4 | [email protected] | Source CodeVendor |
| https://github.com/frappe/lms/security/advisories/GHSA-g5jj-q8m7-359c | [email protected] | AdvisoryRemedyVendor |
| https://github.com/frappe/lms/tree/v2.52.1 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe Learning Management System | < 2.52.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | New CVE Received | [email protected] |
| Oct 30, 2026 | CVE Modified | CISA-ADP |