{"id":"CVE-2026-61803","kind":"vulnerability","aliases":["CVE-2026-61803"],"related":[],"title":"Frappe LMS: client-set prices let users buy courses for less","description":"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.","summary":"Frappe Learning Management System trusts a price sent from the browser during course and certificate checkout. A logged-in user can complete a paid purchase for any amount they choose.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-learning","frappe-lms","package","self-hosted"],"not_affected_if":["free-courses-only","version-2.52.1-or-later"],"how_to_check":"- Check the installed Frappe LMS version (for example with `bench version` or the app's `pyproject.toml`) and see whether it is below `2.52.1`.\n- Review whether paid courses or paid certificates are enabled on the site.","fix":"- Frappe LMS: upgrade to `2.52.1` or later.","status":"open","published_at":"2026-10-30T17:17:26+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:15+00:00","updated_at":"2026-10-30T17:32:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe LMS: upgrade to `2.52.1` or later.","reach":"internet","title":"Frappe LMS: client-set prices let users buy courses for less","impact":"low","summary":"Frappe Learning Management System trusts a price sent from the browser during course and certificate checkout. A logged-in user can complete a paid purchase for any amount they choose.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-lms","self-hosted","e-learning"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Logged-in users buy paid courses or certificates for less than the list price.","analyst_note":"","how_to_check":"- Check the installed Frappe LMS version (for example with `bench version` or the app's `pyproject.toml`) and see whether it is below `2.52.1`.\n- Review whether paid courses or paid certificates are enabled on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["free-courses-only","version-2.52.1-or-later"],"who_is_affected":"Sites running Frappe LMS before 2.52.1 that sell paid courses or certificates are exposed, because checkout accepts a client-supplied price. Sites with no paid items, or with only free courses, are unlikely to be affected. Exploitation requires an authenticated account, and the flaw does not expose other users' data.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4165,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61803':15A,18A '2.52.1':78C,134C 'accept':83C 'actual':107C 'allow':88C 'amount':57B,103C 'authent':90C 'browser':39B 'busi':113C 'business-log':112C 'buy':9A 'certif':43B,99C 'checkout':44B,81C 'choos':59B 'client':4A,85C 'client-control':84C 'client-set':3A 'complet':51B,93C 'content':74C 'control':86C 'cours':10A,41B,97C 'course/certificate':80C 'cve':13A,16A 'data':123C 'e':20B 'e-learn':19B 'elev':126C 'expos':120C 'fix':131C 'flow':82C 'frapp':1A,23B,29B,60C 'frappe-lm':22B 'grant':125C 'help':70C 'host':28B 'integr':115C 'issu':116C,129C 'learn':21B,30B,61C,67C 'less':12A 'let':7A 'lms':2A,24B,64C 'log':47B 'logged-in':46B 'logic':114C 'manag':31B,62C 'packag':25B 'paid':53B,96C 'paid-cours':95C 'price':6A,35B,87C,108C 'prior':75C 'privileg':127C 'purchas':54B,100C 'self':27B 'self-host':26B 'sent':36B 'set':5A 'structur':72C 'system':32B,63C,68C 'trust':33B 'user':8A,49B,71C,91C,122C 'version':77C,133C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe LMS before 2.52.1 that sell paid courses or certificates are exposed, because checkout accepts a client-supplied price. Sites with no paid items, or with only free courses, are unlikely to be affected. Exploitation requires an authenticated account, and the flaw does not expose other users' data.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61803","severity":null,"published_at":"2026-10-30T17:17:26+00:00","modified_at":"2026-10-30T17:17:26+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}