| Title | Frappe Frappe LMS 2.40.0 Improper Access Controls |
|---|
| Description | Frappe LMS 2.40.0 – Access to Unpublished Courses via Predictable Slugs
Summary
Frappe LMS version 2.40.0 is vulnerable to an access control bypass where unpublished course content remains accessible through predictable slug-based URLs. Although direct access to an unpublished course page (e.g. /lms/courses/linux-administration/) correctly redirects to the courses listing, an attacker can still access course content and lessons via URLs such as /lms/courses/linux-administration/learn/1-1, even if the course is not published.
Vulnerability Details
The application enforces publication checks on the course overview endpoint, but fails to consistently enforce them on lesson/learning endpoints under the /learn/[chapter]-[item] structure.
Key points:
- Unpublished courses should not be accessible to students or unauthenticated users.
- The slug pattern /lms/courses/[COURSE_NAME]/learn/1-1 exposes chapter and lesson content even when the course is unpublished.
- A student can also enroll into an unpublished course by accessing these direct URLs.
This constitutes a broken access control vulnerability. It's a bypass for CVE-2025-11281.
CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Steps to Reproduce
1. Log in as an instructor.
- Navigate to the courses page: /lms/courses
2. Create a new course.
- Create a course (e.g. linux-administration).
- Add at least one chapter and one lesson or assignment in Chapter 1.
3. Ensure the course is unpublished.
- In the course settings, leave the “Published” checkbox unchecked.
4. Attempt to access the course overview (blocked as expected).
- As a student or unauthenticated user, open: /lms/courses/linux-administration/
- You are redirected to the courses page.
5. Bypass using the predictable lesson slug.
- As a student or unauthenticated user, open: /lms/courses/linux-administration/learn/1-1
- Chapter and lesson names and content are accessible even though the course is unpublished.
6. Test with other course names.
- For any known course slug, access: /lms/courses/[COURSE_NAME]/learn/1-1
- You may be able to view unpublished course content and in some cases enroll or continue learning.
Impact
- Exposure of unpublished course content: Draft or embargoed material can be accessed early.
- Leakage of lesson/assignment content: Attackers can view course structure, lessons, assignments, and exam-like material.
- Predictable enumeration: Slugs such as learn/1-1, learn/1-2, etc., make enumeration trivial.
- Business/academic integrity risk: Unauthorized access to course material can undermine schedules, exam integrity, or paid content models.
This is a high-impact confidentiality issue because it breaks the core publish/unpublish model of the LMS. |
|---|
| Source | ⚠️ https://gist.github.com/0xHamy/d978d5dc2730b2b2c10649255f067a34 |
|---|
| User | 0xHamy (UID 88518) |
|---|
| Submission | 12/02/2025 19:57 (10 months ago) |
|---|
| Moderation | 12/10/2025 08:23 (8 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 327015 [Frappe LMS 2.35.0 Unpublished Course /courses/ access control] |
|---|
| Points | 0 |
|---|