CVE-2026-61805 Details
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
An authorization vulnerability has been identified in Frappe Learning Management System (LMS) versions prior to 2.54.0. The issue allows authenticated students to manipulate quiz submission records. Due to inadequate server-side authorization, students can submit passing or perfect quiz results without their answers being verified, thereby unlocking course completion and certificates. Additionally, students can create submissions on behalf of other users, depleting their allowed attempts and preventing legitimate submissions. While this vulnerability disrupts the integrity and availability of quiz results, it does not compromise other users' data or grant elevated roles.
Users are advised to upgrade to Frappe Learning Management System version 2.54.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386 | [email protected] | Source CodeVendor |
| https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh | [email protected] | AdvisoryRemedyVendor |
| https://github.com/frappe/lms/tree/v2.54.0 | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe Learning Management System | < 2.54.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |