CVE-2026-39415

Awaiting Analysis Awaiting Analysis - Queue

Client-Side Score Manipulation in Frappe LMS Prior to

Publication date: 2026-04-08

Last updated on: 2026-04-13

Assigner: GitHub, Inc.

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-08

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-39415

EUVD

EUVD-2026-20603

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	learning	From 2.0.0 (inc) to 2.46.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-602	The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

Executive Summary

The vulnerability in Frappe Learning Management System (LMS) prior to version 2.46.0 allows students to modify their quiz scores before submission.

This happens because the application relies on client-side calculated scores, which can be altered using browser developer tools before the submission request is sent.

While this does not allow modification of other users' data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability.

Impact Analysis

This vulnerability impacts the integrity of quiz results by allowing students to alter their scores before submission.

It undermines academic reliability because the scores submitted may not reflect the actual performance of the students.

However, it does not expose confidential information, allow unauthorized access to other accounts, or enable privilege escalation.

Compliance Impact

This vulnerability affects data integrity but does not expose confidential information or allow unauthorized access to other accounts.

Therefore, it primarily undermines the reliability of academic data rather than directly impacting compliance with standards focused on data privacy and protection such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Frappe Learning Management System to version 2.46.0 or later, where the issue has been fixed.

Since the vulnerability involves client-side manipulation of quiz scores, relying on server-side validation of quiz results can also help maintain data integrity.

Hi! I’m here to help you understand CVE-2026-39415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70