Executive brief
Frappe LMS is an open-source platform used to manage and deliver online courses. A security flaw in the system allowed users to enroll in paid courses without paying by exploiting a weakness in how course batches were validated. This could lead to a loss of revenue for educational providers using the platform.
Technical details
An authentication bypass vulnerability (CWE-288) exists in Frappe LMS versions up to 2.51.0. The vulnerability resides in the enrollment logic, where the system failed to verify that a provided 'batch' identifier was actually associated with the specific course being accessed. By supplying an unrelated batch ID, a remote authenticated user could bypass the payment validation checks required for paid courses. This allows unauthorized access to restricted course content. The fix introduced in version 2.52.0 ensures that the enrollment process validates the link between the batch and the course.
Affected products
- Frappe LMS <= 2.51.0
Timeline
- 2026-06-24: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD