CVE-2026-61805 in LMS
Summary
by MITRE • 10/30/2026
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Frappe Learning Management System, a platform designed to help educators structure and deliver educational content, suffered from significant authorization flaws prior to version 2.54.0 that compromised the integrity of its assessment mechanisms. The core vulnerability stemmed from inadequate server-side validation during quiz submission processes. Specifically, the application failed to enforce proper access controls on REST API endpoints responsible for recording quiz results. This architectural oversight allowed authenticated users with student privileges to manipulate their academic records by bypassing standard verification procedures. By exploiting this weakness, an attacker could submit a quiz result indicating a perfect score or passing grade without actually answering any questions correctly. The system accepted these fabricated submissions and automatically processed them as valid achievements, thereby triggering downstream actions such as marking courses as complete and issuing certificates of completion. This represents a critical failure in ensuring that the data recorded by the application accurately reflects the user's actual performance and effort, undermining the fundamental trust model of an educational platform where credentials are directly tied to demonstrated competency.
Beyond the ability to falsify personal results, this vulnerability also facilitated abuse regarding attempt limits and resource allocation for other users. An authenticated student could exploit the same REST bypass mechanism to create quiz submissions attributed to different user accounts within the system. This capability allowed malicious actors to exhaust the limited number of attempts allocated to specific students or courses by submitting dummy data under their names. By artificially consuming these allowances, attackers effectively blocked legitimate users from taking quizzes they were entitled to attempt due to quota exhaustion. This behavior introduces a denial-of-service condition relative to educational resources and access rights, disrupting the learning process for targeted individuals. The impact is strictly scoped to quiz results and associated completion metrics; it does not extend to exposing sensitive personal data of other users or granting administrative privileges, which limits the scope but does not diminish the severity of the integrity violations within the assessment module.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as the application failed to enforce appropriate role-based access controls on critical business logic functions. The ability for an authenticated user to perform actions outside their intended scope by manipulating API inputs is characteristic of Broken Access Control vulnerabilities often cataloged under OWASP Top 10 categories related to insufficient server-side validation. In terms of adversary tactics, this exploitation technique maps to the ATT&CK framework's Tactic TA0005 Defense Evasion and specifically aligns with techniques involving manipulation of system processes or data integrity for unauthorized gain. The lack of proper authorization checks on REST endpoints allows attackers to bypass intended security boundaries without needing higher-level credentials, relying instead on the application's trust in client-supplied identifiers and status flags during submission events.
To mitigate this vulnerability, organizations must upgrade Frappe LMS to version 2.54.0 or later, where these server-side authorization checks have been implemented. Until an upgrade is feasible, administrators should monitor API logs for anomalous patterns of quiz submissions that occur at unrealistic speeds or from unusual IP addresses associated with single users submitting multiple distinct attempts rapidly. Implementing rate limiting on the specific REST endpoints responsible for quiz result submission can also help mitigate abuse by preventing rapid-fire requests that characterize this type of exploitation. Furthermore, enforcing strict server-side validation where every submitted answer is independently verified against a correct key before recording any status change ensures that completion metrics remain accurate and tamper-proof. Regular audits of user attempt logs can help identify accounts exhibiting suspicious behavior indicative of automated submission scripts or manual manipulation attempts.