High severityNVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026

CVE-2026-39385

Description

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.

Affected products

Frappe/Lmsllm-fuzzy
Range: <=2.51.0

Patches

Vulnerability mechanics

References

github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgcnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000