Frappe LMS allows unpublished certificate access

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…pe/lms/security/advisories/GHSA-xjj9-h64v-254g Diğer
• github.com/…ommit/e0a898825ebf924f376ff8985c4248fc48139cf5 Diğer
• github.com/frappe/lms/tree/v2.54.2 Diğer

Kayıt geçmişi

1. 30 Eki 2026 20:02Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgery
• 5,3 CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
• 5,1 CVE-2026-39375Frappe LMS has Stored XSS in Course Meta
• 5,3 CVE-2026-62056WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability
• 4,3 CVE-2026-62023WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability
• 4,3 CVE-2026-62019WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability