Frappe LMS CVE-2026-61803

Requires an authenticated LMS user account (PR:L) and a site that actually offers paid courses or certificates with the payment/checkout flow enabled. The attacker exploits it by altering the client-supplied pricing values (amount, discount_amount, gst_amount, currency) that the pre-2.52.1 checkout sent to get_payment_link, which the server trusted instead of recomputing. Limiting factors: exploitation is impossible on sites with no paid offerings, it needs valid authentication so it is not anonymous, and impact is confined to financial/pricing integrity - it does not yield other users' data, code execution, or privilege escalation. The fix (v2.52.1) determines all pricing server-side via get_order_summary, so upgrading is the only complete remedy; the advisory lists no workaround.

This is a moderate, business-logic integrity flaw, not a system-compromise bug. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring an authenticated account (PR:L), with impact limited to low integrity (VI:L) and no confidentiality or availability impact - consistent with the advisory's statement that it does not expose other users' data or grant elevated privileges. The priority signal is vuln.today 'this_month' (not act_now/emergency). No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no evidence of active or probable exploitation; the only public artifacts are the GHSA advisory and the fix commit. The practical risk is financial: an authenticated user can buy a paid course or certificate for an attacker-chosen amount (including near-zero), causing direct revenue loss to platform operators. Note a data-labeling conflict: the input CWE is CWE-502 (Deserialization) and a 'Deserialization' tag is attached, but the description, advisory, and patch all describe client-controlled pricing accepted by the server - a trust/input-validation issue, not deserialization - so the deserialization classification appears mislabeled and should not drive triage.

An authenticated user on a Frappe LMS site that sells paid courses or certificates begins the checkout flow and tampers with the client-supplied pricing values (e.g. amount/discount_amount) sent when generating the payment link, then completes the purchase for an amount other than the real price. Because pricing was trusted from the client rather than recomputed server-side, the enrollment or certificate is granted for the manipulated (potentially zero) amount. No public exploit code was identified, but the fix commit publicly reveals the mechanism, lowering the bar to reproduce.