CVE-2026-61805— Frappe LMS: Quiz result manipulation and cross-user submission forgery

Quick assessment

Affected

frappe lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Frappe 学习管理系统（LMS）是一个帮助用户结构化其内容的学习平台。在 2.54.0 版本之前，服务器对测验提交记录的授权不足。攻击者可通过接口绕过验证，使已认证的学生无需经过答案核验即可记录通过或满分成绩，从而解锁课程完成状态并获取证书。此外，该学生还可创建归属于其他用户的提交记录，耗尽这些用户的允许尝试次数，进而阻止其正常提交。此类完整性与可用性问题仅限于测验结果，不会泄露其他用户数据，也不会赋予更高权限。该问题已在 2.54.0 版本中修复。

CVSS 5.3 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1552.001 · Credentials In Files T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe LMS: Quiz result manipulation and cross-user submission forgery

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	lms	< 2.54.0	-

II. Public POCs for CVE-2026-61805

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61805

请登录查看更多情报信息。

Other References for CVE-2026-61805 (3)

https://github.com/frappe/lms/tree/v2.54.0 x_refsource_MISC
https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh x_refsource_CONFIRM
https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61805

Same Patch Batch · frappe · 2026-10-30 · 4 CVEs total

CVE-2026-61803	5.3 MEDIUM	Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbit
CVE-2026-61806	5.3 MEDIUM	Frappe LMS allows unpublished certificate access
CVE-2026-39375	5.1 MEDIUM	Frappe LMS has Stored XSS in Course Meta

IV. Related Vulnerabilities

Same product: lms

Same vendor: frappe

Same weakness: CWE-862