---
id: "CVE-2026-61806"
kind: "vulnerability"
aliases: ["CVE-2026-61806"]
title: "Frappe LMS: unpublished certificate records readable by unauthorized users"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frappe", "frappe-lms", "package", "self-hosted"]
not_affected_if: ["published-only-certificates", "version-2.54.2-or-later"]
published_at: "2026-10-30T17:17:27+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61806", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# Frappe LMS: unpublished certificate records readable by unauthorized users

Frappe Learning Management System stores certificate records that are not published, and before version 2.54.2 other users could retrieve and view them. An attacker can see certificate details belonging to other people, but cannot change data or gain extra privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe LMS version with `bench version` or the app list in the Frappe site.
- Confirm whether the site exposes certificate records to logged-in users other than owners and staff.

## Fix

- Move Frappe LMS to `2.54.2` or later.

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61806

## From the sources

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_