CVE-2026-61805

    Dashboard / Vulnerabilities / CVE-2026-61805

    CVE-2026-61805

    Published: 30 Oct 2026Last Modified: 5 Nov 2026

    Summary: Frappe LMS: Quiz result manipulation and cross-user submission forgery

    Details: Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.

    References: https://github.com/frappe/lms/tree/v2.54.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61805.json, https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh, https://nvd.nist.gov/vuln/detail/CVE-2026-61805, https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -44edd52ae01c9fd29f6399912d5be7cfc79aeb67

    Affected versions

    v2.53.2
    v2.53.1
    v2.53.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61805 | CVE-DB