CVE-2026-39385 — Frappe LMS enrollment bypass in paid courses via unrelated batch

CVE-2026-39385

Frappe LMS enrollment bypass in paid courses via unrelated batch PUBLISHED

Description (CNA)

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Affected (CNA)

Vendor / product	Versions
frappe / lms	affected <= 2.51.0

CWE

CWE-288

References

https://github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.