CVE-2026-61805

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.

• CWE-862

• https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386
• https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh
• https://github.com/frappe/lms/tree/v2.54.0

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61801The `github.com/moby/sys/user` package provides Go utilities…5.5
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61803Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61804myTinyWMS is a free, open-source warehouse management system…8.1
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.1
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-61811Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61814Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's A…7.5