CVE-2026-26977 — Frappe Learning Management System exposes details of unpublished courses to unauthorized users

CVE-2026-26977

Frappe Learning Management System exposes details of unpublished courses to unauthorized users PUBLISHED

Description (CNA)

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.

Affected (CNA)

Vendor / product	Versions
frappe / lms	affected <= 2.44.0

CWE

CWE-862, CWE-284

References

https://github.com/frappe/lms/security/advisories/GHSA-26vf-p39q-frx3

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.