Medium severity5.3NVD Advisory· Published Feb 20, 2026· Updated Jun 17, 2026

CVE-2026-26977

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Learning
cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*
Range: >=2.0.0,<2.45.0
Frappe/Learning Management Systemllm-fuzzy
Range: <=2.44.0
Frappe/Lmsllm-fuzzy2 versions
<=2.44.0+ 1 more
- (no CPE)range: <=2.44.0
- (no CPE)range: <= 2.44.0

Patches

Vulnerability mechanics

References

github.com/frappe/lms/security/advisories/GHSA-26vf-p39q-frx3nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000