CVE-2026-61806 Details
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.
A vulnerability in Frappe Learning Management System (LMS) prior to version 2.54.2 allows users to access unpublished certificate records that should be restricted to the certificate owner and authorized staff. This flaw could lead to unauthorized exposure of certificate details belonging to other users. Access to published certificates by their identifier is intentionally allowed for third-party verification and remains unaffected by this issue. The vulnerability does not permit data modification or elevation of privileges.
Users are advised to upgrade to Frappe Learning Management System version 2.54.2 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/lms/commit/e0a898825ebf924f376ff8985c4248fc48139cf5 | [email protected] | Source CodeVendor |
| https://github.com/frappe/lms/security/advisories/GHSA-xjj9-h64v-254g | [email protected] | AdvisoryRemedyVendor |
| https://github.com/frappe/lms/tree/v2.54.2 | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe Learning Management System | < 2.54.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |