PT-2026-61650 · Frappe · Frappe Lms

CVE-2026-39385 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe LMS versions prior to 2.52.0

Description A flaw in the payment validation process allows a user to bypass payment requirements for courses by utilizing an unrelated batch. This occurs because the enrollment process fails to verify if the batch is correctly linked to the specific course.

Recommendations Update to version 2.52.0.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-39385

GHSA-C4XH-2RCM-6MGC

Affected Products

Frappe Lms

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39385.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39385 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39385 · Vendor Advisory
• https://github.com/frappe/lms/security/advisories/GHSA-c4xh-2rcm-6mgc · Note