CVE-2026-61803 in LMS
Summary
by MITRE • 10/30/2026
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Frappe Learning Management System, designed to help educators and institutions structure and deliver educational content, contains a critical business logic vulnerability in its course and certificate checkout workflow prior to version 2.52.1. This flaw stems from an insecure direct object reference or improper validation of server-side pricing parameters during the transaction process. Specifically, the application fails to enforce authoritative price data on the backend when processing payments for paid courses or certificates. Instead, it relies partially or entirely on client-supplied values sent by the authenticated user's browser session. This architectural oversight allows a malicious actor who has successfully authenticated into the system to manipulate the HTTP request payload and substitute the actual cost of an educational resource with a significantly lower value or even zero.
From a technical perspective, this vulnerability represents a classic case of business logic abuse where the integrity of financial transactions is compromised due to insufficient server-side validation. The application trusts input from the client side without cross-referencing it against the canonical price stored in the database for that specific course or certificate item. This lack of reconciliation between the requested amount and the actual cost creates a direct path for economic exploitation. An attacker can intercept the checkout request, modify the price parameter to any arbitrary integer value, and submit the transaction. The system processes this altered data as valid, resulting in the issuance of access rights to premium content without charging the correct fee.
The operational impact of this vulnerability is primarily financial loss for the service provider rather than a compromise of user privacy or system integrity. Because the flaw does not involve privilege escalation or unauthorized access to other users' personal data, it falls under the category of business logic errors that affect revenue streams. However, the severity lies in its ease of exploitation and direct correlation to monetary theft. Attackers can systematically purchase high-value courses at discounted rates or for free, leading to significant cumulative financial damage over time if left unpatched. This type of vulnerability undermines trust in the platform's payment infrastructure and can lead to legal liabilities regarding fair service delivery.
This issue aligns with CWE-840, which describes Business Logic Errors where the application performs an action contrary to its design or intent. Furthermore, it maps to MITRE ATT&CK technique T1536, specifically within the context of supply chain compromise if viewed broadly, but more accurately fits under local privilege escalation in terms of gaining unauthorized access to paid resources without proper authentication of payment status. It also relates to CWE-209, which involves the generation of an error message that includes sensitive information, although here the issue is less about leakage and more about bypassing controls. The vulnerability highlights a common pitfall in web development where frontend validation is mistaken for sufficient security control, ignoring the necessity of authoritative backend verification for all financial transactions.
To mitigate this risk, it is imperative to implement strict server-side price validation on every transaction request. Developers must ensure that the final amount charged is derived exclusively from trusted sources within the application's database or configuration files, never accepting monetary values directly from client inputs such as HTTP POST parameters or JSON payloads. Additionally, implementing idempotency keys and robust audit logging for all payment-related actions can help detect anomalous pricing patterns early. Upgrading to version 2.52.1 resolves this issue by correcting the checkout flow logic to enforce accurate pricing regardless of client-side modifications. Organizations relying on older versions should prioritize immediate patching to prevent further exploitation and potential financial loss. Regular security audits focusing on business logic integrity are recommended for all e-commerce or subscription-based modules within learning management systems to ensure that access controls remain tightly coupled with verified payment status.