Frappe LMS CVE-2026-46546

Exploitation requires a valid, low-privilege authenticated account on the target Frappe LMS instance (PR:L in CVSS vector), such as a self-registered student. The attacker must have write access to user-editable fields whose content is reflected in page metadata - the specific fields are not named in the advisory but are described as 'certain user-editable fields.' Additionally, AT:P (Attack Requirements: Present) in the CVSS 4.0 vector indicates a specific condition must exist beyond mere authentication - the injected content must be surfaced on a page that another user visits (UI:P, passive interaction). Exploitation is therefore limited by: (1) requiring an authenticated account rather than unauthenticated access; (2) requiring a victim to visit the poisoned page; and (3) requiring the injected content to reach the metadata rendering path. Unauthenticated external attackers cannot exploit this directly.

The CVSS 4.0 base score of 2.1 (Low) is consistent with the available signals. The vector AV:N/AC:L/AT:P/PR:L/UI:P indicates network-reachable exploitation requiring low-privilege authentication, a specific attack prerequisite (AT:P - the injected content must be surfaced in metadata visible to other users), and passive victim interaction. Integrity impact is limited (VI:L) and there is no confidentiality or availability impact on either the vulnerable or subsequent system scope. No EPSS score was provided in the intelligence data, and no CISA KEV listing exists, meaning active exploitation is not confirmed. No POC code has been identified at time of analysis. The combination of authentication requirement, passive UI dependency, low impact scores, and absence of any exploitation signal confirms this as a genuine low-priority issue. The main realistic risk vector is phishing: a malicious authenticated user (e.g., a self-registered student) poisoning course or profile pages to redirect other authenticated users to credential-harvesting sites - a social engineering amplifier, not a direct system compromise.

A self-registered student account injects a crafted redirect URL into a profile or course content field that the LMS reflects into page metadata. When an instructor or fellow student visits the affected course page, their browser silently navigates them to an attacker-controlled phishing site mimicking the LMS login portal, where credentials are harvested. No public POC code has been identified, but the technique is straightforward for any attacker with a valid account.