cve-2026-61805

MEDIUM CVSS 5.3 gcve_enriched
Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.

Timeline
Published
2026-10-30 17:01 UTC
Last Modified
2026-11-04
CVSS Details
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Affected Products
  • frappe lms
Weaknesses (CWE)
CWE-862
SSVC (CISA Stakeholder-Specific Vulnerability Categorization) CISA Coordinator v2.0.3
Exploitation
none
Automatable
no
Technical Impact
partial
Decision timestamp
2026-11-04T23:02:28.922644Z

What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61805",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T23:02:28.922644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T23:02:40.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.54.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:01:42.988Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh"
        },
        {
          "name": "https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386"
        },
        {
          "name": "https://github.com/frappe/lms/tree/v2.54.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/lms/tree/v2.54.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4566-2phx-68gh",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe LMS: Quiz result manipulation and cross-user submission forgery",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "CVE-2026-61805"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61805",
    "datePublished": "2026-10-30T17:01:42.988Z",
    "dateReserved": "2026-07-10T20:06:05.618Z",
    "dateUpdated": "2026-11-04T23:02:40.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61805",
      "date": "2026-11-04",
      "epss": "0.00218",
      "percentile": "0.12342"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-61805\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-10-30T17:17:27.220\",\"lastModified\":\"2026-11-04T23:17:56.450\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"frappe\",\"product\":\"lms\",\"versions\":[{\"version\":\"< 2.54.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-11-04T23:02:28.922644Z\",\"id\":\"CVE-2026-61805\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/frappe/lms/tree/v2.54.0\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Frappe LMS: Quiz result manipulation and cross-user submission forgery\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-862\", \"lang\": \"en\", \"description\": \"CWE-862: Missing Authorization\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/frappe/lms/security/advisories/GHSA-4566-2phx-68gh\"}, {\"name\": \"https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/frappe/lms/commit/876504f3900512f528b6e4a7bd3a15673eedd386\"}, {\"name\": \"https://github.com/frappe/lms/tree/v2.54.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/frappe/lms/tree/v2.54.0\"}], \"affected\": [{\"vendor\": \"frappe\", \"product\": \"lms\", \"versions\": [{\"version\": \"< 2.54.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-30T17:01:42.988Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.\"}], \"source\": {\"advisory\": \"GHSA-4566-2phx-68gh\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-61805\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-04T23:02:28.922644Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-04T23:02:36.813Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-61805\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-07-10T20:06:05.618Z\", \"datePublished\": \"2026-10-30T17:01:42.988Z\", \"dateUpdated\": \"2026-11-04T23:02:40.996Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  },
  "x_gcve": [
    {
      "extensions": {
        "bcp-05-x-01": {
          "ai_annotations": [
            {
              "ai_level": "generated",
              "description": "VLAI severity classification was generated by Vulnerability-Lookup's /vlai/severity-classification API endpoint based on vulnerability description text.",
              "field_name": "x_gcve.extensions.vlai-severity-enrichment",
              "models": [
                {
                  "gna_source": 1,
                  "identifier": "vlai-severity-classification",
                  "name": "VLAI Severity",
                  "provider": "CIRCL",
                  "version": "fc530b2263ef5a89ae4c75ffcbf6b4d878d44b94"
                }
              ],
              "review_status": "none",
              "scope": "field",
              "tags": [
                "ai-computer-assisted:assistance-level=\"ai-generated\"",
                "ai-computer-assisted:review-level=\"unreviewed\""
              ]
            }
          ]
        },
        "vlai-severity-enrichment": {
          "confidence": 0.950011670589447,
          "generated_at": "2026-11-05T00:25:10+00:00",
          "severity": "Medium",
          "vulnerability_id": "CVE-2026-61805"
        }
      }
    }
  ]
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
GCVE AI Severity
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON