PT-2026-7726 · Frappe · Frappe Learning Management System

Filime · Published 2026-02-11 · Updated 2026-02-12 · CVE-2026-26031

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Frappe Learning Management System versions prior to 2.44.0

Description A security issue was identified in Frappe Learning Management System where unauthorized users could access the full list of enrolled students, including their email addresses, in batches.

Recommendations Update to version 2.44.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-26031

GHSA-3GW9-GWJM-VCQ5

Affected Products

Frappe Learning Management System

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26031.json · Exploit
• https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26031 · Security Note
• https://github.com/frappe/lms/releases/tag/v2.44.0 · Note
• https://twitter.com/CVEnew/status/2021714589919085049 · Twitter Post
• https://t.me/cveNotify/151854 · Telegram Post