CVE-2026-39385 | Frappe LMS is an open source learning management system. In … | CVSS 7.1 HIGH

Description

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Metadata

CVE ID: CVE-2026-39385
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-06 22:06 UTC
Published: 2026-07-20 16:55 UTC
Last updated: 2026-07-20 19:07 UTC
Primary CWE: CWE-288
CWE-288: Authentication Bypass Using an Alternate Path or Ch…
Vendor / Product: frappe / lms
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
frappe	lms	—	<= 2.51.0

Weakness (CWE)

CWE	Source	Description
CWE-288	cna	CWE-288: Authentication Bypass Using an Alternate Path or Channel

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (1)

https://github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgc https://github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgc