CVE-2025-64705 — Frappe user was able to access the submission of other students

CVE-2025-64705

Frappe user was able to access the submission of other students PUBLISHED

Description (CNA)

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.

Affected (CNA)

Vendor / product	Versions
frappe / lms	affected >= 2.0.0, < 2.41.0

CWE

CWE-200

References

https://github.com/frappe/lms/security/advisories/GHSA-qrvv-6g7r-g3v8

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.