Which versions of Lms are affected by CVE-2026-39385?

Frappe LMS versions 2.51.0 and earlier contain a payment validation bypass that allows authenticated users to enroll in paid courses for free, directly impacting revenue collection and granting…

How to fix or mitigate CVE-2026-39385?

Within 24 hours, inventory all Frappe LMS deployments and identify instances running version 2.51.0 or earlier, assessing exposure in terms of affected paid courses and user populations. Within 7 days, upgrade all vulnerable Frappe LMS instances to version 2.52.0, which implements authorization verification to ensure batches are properly linked to courses before enrollment. Within 30 days, complete full regression testing and validation of the patch across all production environments to confirm no disruptions to enrollment workflows.

Lms CVE-2026-39385

Q: What is the CVSS score of CVE-2026-39385?

CVE-2026-39385 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46029 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-20 GitHub_M

Authentication Bypass Lms

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:10 vuln.today

CVE Published

Jul 20, 2026 - 16:55 cve.org

HIGH 7.1

DescriptionCVE.org

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

AnalysisAI

Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.