Frappe LMS CVE-2026-61805

The attacker must hold an authenticated LMS student account and be able to reach the Frappe REST API (PR:L); no special or non-default configuration is required, because the LMS Quiz Submission doctype lacked adequate server-side authorization and permitted direct create/write of submission records. Exploitation is limited to quiz-result records: it cannot expose other users' data or grant elevated roles, and it requires valid session authentication, so it is not reachable by fully unauthenticated attackers. The attempt-exhaustion/DoS variant additionally depends on the target quiz enforcing a maximum-attempts limit, since the original code counted attempts against frappe.session.user rather than the submission's member.

This is a genuine but moderate-priority integrity/availability issue rather than a critical infrastructure flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) is self-consistent and matches the description: network-reachable, low complexity, but requiring an authenticated student (PR:L) and causing only low integrity and availability impact limited to quiz results - no confidentiality impact and no privilege escalation. The input provides no EPSS score and no CISA KEV listing, and the only references are the vendor advisory, the fix commit, and the release tag - i.e. no public exploit or PoC reference, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with the medium 5.3 score and the absence of active-exploitation signals; none of the signals conflict. The practical risk is academic-integrity fraud (self-awarded certificates) and a targeted denial of a specific user's quiz attempts, not data theft or system compromise, so this should be scheduled for routine patching rather than treated as an emergency.

An authenticated student uses the Frappe LMS REST API to directly create a Quiz Submission record showing a passing or perfect score without their answers ever being validated server-side, thereby unlocking course completion and a certificate. The same weakness lets them submit a record attributed to another user, consuming that victim's allowed attempts and blocking their legitimate submission. No public exploit code is identified; only the vendor patch commit is published.