Live › vulnerability › CVE-2026-61806
Frappe Learning Management System stores certificate records that are not published, and before version 2.54.2 other users could retrieve and view them. An attacker can see certificate details belonging to other people, but cannot change data or gain extra privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Organizations running Frappe LMS versions before 2.54.2 where learners have accounts on the same site. Published certificates are reached by identifier for third-party verification and are not affected. Sites that do not run Frappe LMS can skip it.
No product ranges from the sources yet.
bench version or the app list in the Frappe site.2.54.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-61806")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.