CVE-2026-61803— Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Quick assessment

Affected

frappe lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe 学习管理系统（LMS）是一款帮助用户组织内容的学习平台。在 2.52.1 版本之前，（课程/证书结账）流程允许客户端自行控制价格，导致已认证用户可以以非实际标价完成付费课程或证书的购买。这是一个业务逻辑完整性问题；该漏洞不会泄露其他用户的数据，也不会授予更高权限。此问题已在 2.52.1 版本中修复。

CVSS 5.3 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	lms	< 2.52.1	-

II. Public POCs for CVE-2026-61803

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61803

请登录查看更多情报信息。

Other References for CVE-2026-61803 (3)

https://github.com/frappe/lms/tree/v2.52.1 x_refsource_MISC
https://github.com/frappe/lms/security/advisories/GHSA-g5jj-q8m7-359c x_refsource_CONFIRM
https://github.com/frappe/lms/commit/1d04f4fd917b62f5dd4442a541280fc40a4178b4 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61803

Same Patch Batch · frappe · 2026-10-30 · 4 CVEs total

CVE-2026-61805	5.3 MEDIUM	Frappe LMS: Quiz result manipulation and cross-user submission forgery
CVE-2026-61806	5.3 MEDIUM	Frappe LMS allows unpublished certificate access
CVE-2026-39375	5.1 MEDIUM	Frappe LMS has Stored XSS in Course Meta

IV. Related Vulnerabilities

Same product: lms

Same vendor: frappe

Same weakness: CWE-502