Payment validation bypass in Frappe LMS enrollment via unrelated batch (CVE-2026-39385)

Frappe LMS versions 2.51.0 and earlier allow a user to bypass payment validation for paid courses by enrolling through an unrelated batch. This vulnerability enables unauthorized access to paid course content without completing payment. The issue has been resolved by enforcing that the batch used for enrollment is linked to the target course. Affected versions: - <= 2.51.0 We recommend updating to: 2.52.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgc Details: https://vuln.today/cve/CVE-2026-39385