CVE-2026-39415
Awaiting Analysis Awaiting Analysis - Queue
Client-Side Score Manipulation in Frappe LMS Prior to

Publication date: 2026-04-08

Last updated on: 2026-04-13

Assigner: GitHub, Inc.

Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-13
Generated
2026-06-16
AI Q&A
2026-04-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-39415
EUVD
EUVD-2026-20603
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
frappe learning From 2.0.0 (inc) to 2.46.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in Frappe Learning Management System (LMS) prior to version 2.46.0 allows students to modify their quiz scores before submission.

This happens because the application relies on client-side calculated scores, which can be altered using browser developer tools before the submission request is sent.

While this does not allow modification of other users' data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability.

Impact Analysis

This vulnerability impacts the integrity of quiz results by allowing students to alter their scores before submission.

It undermines academic reliability because the scores submitted may not reflect the actual performance of the students.

However, it does not expose confidential information, allow unauthorized access to other accounts, or enable privilege escalation.

Compliance Impact

This vulnerability affects data integrity but does not expose confidential information or allow unauthorized access to other accounts.

Therefore, it primarily undermines the reliability of academic data rather than directly impacting compliance with standards focused on data privacy and protection such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Frappe Learning Management System to version 2.46.0 or later, where the issue has been fixed.

Since the vulnerability involves client-side manipulation of quiz scores, relying on server-side validation of quiz results can also help maintain data integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart