Authorization Weakness in Frappe Learning Management System Quiz Submissions

CVE-2026-61805

What is CVE-2026-61805?

The Frappe Learning Management System (LMS) has a vulnerability that allows authenticated users to bypass authorization for quiz submissions. Before version 2.54.0, students could submit quiz results without proper verification of their answers. This flaw enables a user to falsely record a high or passing score, facilitating unauthorized course completions and certificate issuance. Additionally, students could claim submissions for other users, which could exhaust their allowed attempts and block genuine submissions. While this issue particularly concerns quiz results, it does not compromise other user data or grant any elevated permissions within the system. The issue has been rectified in version 2.54.0.

References