CVE-2026-61806

    Dashboard / Vulnerabilities / CVE-2026-61806

    CVE-2026-61806

    Published: 30 Oct 2026Last Modified: 1 Nov 2026

    Summary: Frappe LMS allows unpublished certificate access

    Details: Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.

    References: https://github.com/frappe/lms/tree/v2.54.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61806.json, https://github.com/frappe/lms/security/advisories/GHSA-xjj9-h64v-254g, https://nvd.nist.gov/vuln/detail/CVE-2026-61806, https://github.com/frappe/lms/commit/e0a898825ebf924f376ff8985c4248fc48139cf5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -5d57c15429fcf23bdde7a20ed4e5091a9b752b17

    Affected versions

    v2.54.1
    v2.54.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61806 | CVE-DB