---
id: "CVE-2026-61803"
kind: "vulnerability"
aliases: ["CVE-2026-61803"]
title: "Frappe LMS: client-set prices let users buy courses for less"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-learning", "frappe-lms", "package", "self-hosted"]
not_affected_if: ["free-courses-only", "version-2.52.1-or-later"]
published_at: "2026-10-30T17:17:26+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61803", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# Frappe LMS: client-set prices let users buy courses for less

Frappe Learning Management System trusts a price sent from the browser during course and certificate checkout. A logged-in user can complete a paid purchase for any amount they choose.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe LMS version (for example with `bench version` or the app's `pyproject.toml`) and see whether it is below `2.52.1`.
- Review whether paid courses or paid certificates are enabled on the site.

## Fix

- Frappe LMS: upgrade to `2.52.1` or later.

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61803

## From the sources

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_