CVE-2026-39385
Received Received - Intake

Frappe LMS Payment Validation Bypass via Unrelated Batch

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-39385
EUVD
EUVD-2026-46029

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
frappe lms to 2.52.0 (exc)
frappe lms 2.52.0
frappe lms to 2.51.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Frappe LMS (versions 2.51.0 and earlier) allowed users to bypass payment validation for paid courses by enrolling through an unrelated batch. The flaw was fixed in version 2.52.0 by ensuring enrollment validates that the batch is linked to the course.

Detection Guidance

Check Frappe LMS version with: pip show frappe-lms. If version is <=2.51.0, the system is vulnerable. Review enrollment logs for users bypassing payment validation through unrelated batches.

Impact Analysis

If you use Frappe LMS versions up to 2.51.0, an attacker could enroll in paid courses without paying by exploiting this flaw. This could lead to financial losses for course providers and unfair access to paid content.

Compliance Impact

This vulnerability allows unauthorized access to paid courses without proper payment validation, which could lead to improper handling of user data and financial transactions. This may violate compliance requirements under GDPR for data protection and HIPAA for secure transactions, depending on how user data and payments are processed in the system.

Mitigation Strategies

Upgrade Frappe LMS to version 2.52.0 or later immediately. Verify that enrollment validation enforces batch-course linkage. Audit recent enrollments for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39385. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart