CVE-2026-26031

1.3 lowEPSS 0.2%

Low (1.3) in frappe learning. EPSS 0.2% chance of exploitation in the next 30 days.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.

Severity

CVSS 4.0

1.3 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2026-02-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

frappe:learning

References

https://github.com/frappe/lms/releases/tag/v2.44.0
https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5

Check your stack JSON