CVE-2026-39415
Client-Side Score Manipulation in Frappe LMS Prior to
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frappe | learning | From 2.0.0 (inc) to 2.46.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Frappe Learning Management System (LMS) prior to version 2.46.0 allows students to modify their quiz scores before submission.
This happens because the application relies on client-side calculated scores, which can be altered using browser developer tools before the submission request is sent.
While this does not allow modification of other users' data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability.
How can this vulnerability impact me? :
This vulnerability impacts the integrity of quiz results by allowing students to alter their scores before submission.
It undermines academic reliability because the scores submitted may not reflect the actual performance of the students.
However, it does not expose confidential information, allow unauthorized access to other accounts, or enable privilege escalation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability affects data integrity but does not expose confidential information or allow unauthorized access to other accounts.
Therefore, it primarily undermines the reliability of academic data rather than directly impacting compliance with standards focused on data privacy and protection such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Frappe Learning Management System to version 2.46.0 or later, where the issue has been fixed.
Since the vulnerability involves client-side manipulation of quiz scores, relying on server-side validation of quiz results can also help maintain data integrity.