Live › vulnerability › CVE-2026-61805
Frappe Learning Management System before 2.54.0 does not check quiz submissions on the server, so a logged-in student can record a passing or perfect quiz score without answering. A student can also file quiz attempts under another user's account, using up that user's attempts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Sites running Frappe LMS before 2.54.0 where students are authenticated and quizzes gate course completion or certificates. Exposure is limited to quiz results; the sources say other users' data is not exposed and roles are not elevated. Sites without quizzes or without student self-registration can deprioritize.
No product ranges from the sources yet.
package.json or via the bench app list; versions below 2.54.0 are affected.2.54.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-61805")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.