PT-2025-49307 · Frappe · Frappe Lms

Published 2025-12-05 · Updated 2025-12-06 · CVE-2025-66581

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Frappe Learning Management System (LMS) versions prior to 2.41.0

Description A flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. The affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, enabling users with low-privileged roles, such as students, to perform operations intended only for instructors or administrators by directly using the API's.

Recommendations Update to version 2.41.0 or later.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-66581

Affected Products

Frappe Lms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-66581 · Security Note
• https://github.com/frappe/lms/security/advisories/GHSA-2ch7-c74m-432m · Note
• https://twitter.com/CVEnew/status/1997021629419782299 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997102162816455093 · Twitter Post
• https://t.me/CVEtracker/38960 · Telegram Post