{"id":"CVE-2026-61806","kind":"vulnerability","aliases":["CVE-2026-61806"],"related":[],"title":"Frappe LMS: unpublished certificate records readable by unauthorized users","description":"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.","summary":"Frappe Learning Management System stores certificate records that are not published, and before version 2.54.2 other users could retrieve and view them. An attacker can see certificate details belonging to other people, but cannot change data or gain extra privileges.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe","frappe-lms","package","self-hosted"],"not_affected_if":["published-only-certificates","version-2.54.2-or-later"],"how_to_check":"- Check the installed Frappe LMS version with `bench version` or the app list in the Frappe site.\n- Confirm whether the site exposes certificate records to logged-in users other than owners and staff.","fix":"- Move Frappe LMS to `2.54.2` or later.","status":"open","published_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:14+00:00","updated_at":"2026-10-30T17:32:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T17:32:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move Frappe LMS to `2.54.2` or later.","reach":"network","title":"Frappe LMS: unpublished certificate records readable by unauthorized users","impact":"low","summary":"Frappe Learning Management System stores certificate records that are not published, and before version 2.54.2 other users could retrieve and view them. An attacker can see certificate details belonging to other people, but cannot change data or gain extra privileges.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-lms","self-hosted","frappe"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"other users' unpublished certificate details are readable","analyst_note":"","how_to_check":"- Check the installed Frappe LMS version with `bench version` or the app list in the Frappe site.\n- Confirm whether the site exposes certificate records to logged-in users other than owners and staff.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.54.2-or-later","published-only-certificates"],"who_is_affected":"Organizations running Frappe LMS versions before 2.54.2 where learners have accounts on the same site. Published certificates are reached by identifier for third-party verification and are not affected. Sites that do not run Frappe LMS can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":4184,"output_tokens":490,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-61806':12A,15A '2.54.2':38B,82C,153C 'access':97C,118C 'affect':135C 'allow':140C 'attack':47B 'author':107C 'belong':52B,114C 'cannot':57B 'certif':4A,29B,50B,84C,104C,112C,121C 'chang':58B 'content':78C 'could':41B 'cve':10A,13A 'data':59B,142C 'detail':51B,113C 'elev':145C 'expos':111C 'extra':62B 'fix':150C 'frapp':1A,16B,18B,24B,64C 'frappe-lm':17B 'gain':61B,144C 'help':74C 'host':23B 'identifi':124C 'intent':126C 'issu':137C,148C 'learn':25B,65C,71C 'limit':101C 'lms':2A,19B,68C 'manag':26B,66C 'modifi':141C 'owner':105C 'packag':20B 'parti':130C 'peopl':55B 'prior':79C 'privileg':63B,146C 'publish':34B,120C 'rather':98C 'readabl':6A 'record':5A,30B,85C 'retriev':42B,88C 'see':49B 'self':22B 'self-host':21B 'staff':108C 'store':28B 'structur':76C 'system':27B,67C,72C 'third':129C 'third-parti':128C 'unauthor':8A 'unpublish':3A,83C 'user':9A,40B,75C,92C,117C 'verif':131C 'version':37B,81C,152C 'view':44B,90C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Frappe LMS versions before 2.54.2 where learners have accounts on the same site. Published certificates are reached by identifier for third-party verification and are not affected. Sites that do not run Frappe LMS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61806","severity":null,"published_at":"2026-10-30T17:17:27+00:00","modified_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}