Frappe LMS CVE-2026-61806

Requires an authenticated low-privileged account on the Frappe LMS instance (CVSS PR:L); the attacker then retrieves unpublished certificate records by their identifier that should be restricted to the certificate owner and authorized staff. Limiting factors: authentication is required (not anonymous), impact is read-only disclosure of certificate details with no data modification or privilege escalation, and access to published certificates by identifier is intentional and unaffected. All versions prior to 2.54.2 are affected; upgrading to 2.54.2 is the only remediation (vendor states no workaround).

This is a confidentiality-only broken-access-control flaw (CWE-862, Missing Authorization) in Frappe LMS, and the signals consistently point to a moderate, non-urgent issue rather than a top priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium): network-reachable and low-complexity, but requiring PR:L - i.e. an authenticated, low-privileged account - and yielding only low confidentiality impact with no integrity or availability impact (the advisory and description both confirm no data modification and no privilege escalation). The vuln.today decision label is 'this_month', consistent with a medium-severity, address-in-normal-cycle item. No EPSS score, no CISA KEV listing, and no proof-of-concept exploit were provided; the only references are the GHSA advisory, the fix commit, and the release tag. There is no conflict between the vector and the description: both agree exploitation requires an authenticated user who then retrieves unpublished certificate records they do not own. Net assessment: a real but bounded data-exposure issue - worth patching on a normal schedule, not an emergency.

An authenticated low-privileged user of a Frappe LMS instance requests certificate records by their identifier and receives unpublished certificates belonging to other users, exposing certificate details that should be restricted to the owner and authorized staff. No public exploit code was identified; the fix commit shows the root cause was a missing 'and doc.published' check on read/print permission. Exploitation yields only read access to certificate data - no modification or privilege gain.