Vulnerabilities CVE-2026-39385

CVE-2026-39385

High

Open

TLP:CLEAR

Frappe LMS enrollment bypass in paid courses via unrelated batch

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Details

CVSS Score: 7.1
EPSS Score ⓘ: 0.22%

12.5th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Jul 20, 2026
Last Modified: Jul 20, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.