CVE-2026-39385 — Frappe LMS enrollment bypass in paid courses via unrelated batch
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has bee…
Published: 2026-07-20 · CVSS: 7.1 · CVSS 4.0
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7