Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-39385

Frappe LMS enrollment bypass in paid courses via unrelated batch

Description

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe lms

  • <= 2.51.0affected

References