CVE-2026-26031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26031", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T21:36:29.556Z", "datePublished": "2026-02-11T21:32:15.323Z", "dateUpdated": "2026-02-12T15:40:20.046Z"}, "containers": {"cna": {"title": "Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5"}, {"name": "https://github.com/frappe/lms/releases/tag/v2.44.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/lms/releases/tag/v2.44.0"}], "affected": [{"vendor": "frappe", "product": "lms", "versions": [{"version": "< 2.44.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T21:32:15.323Z"}, "descriptions": [{"lang": "en", "value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0."}], "source": {"advisory": "GHSA-3gw9-gwjm-vcq5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T15:40:10.774179Z", "id": "CVE-2026-26031", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T15:40:20.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students", "source": {"advisory": "GHSA-3gw9-gwjm-vcq5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "frappe", "product": "lms", "versions": [{"status": "affected", "version": "< 2.44.0"}]}], "references": [{"url": "https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5", "name": "https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frappe/lms/releases/tag/v2.44.0", "name": "https://github.com/frappe/lms/releases/tag/v2.44.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T21:32:15.323Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T15:40:10.774179Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-12T15:40:16.585Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-26031", "state": "PUBLISHED", "dateUpdated": "2026-02-11T21:32:15.323Z", "dateReserved": "2026-02-09T21:36:29.556Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-11T21:32:15.323Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lms", "vendor": "frappe", "versions": [{"status": "affected", "version": "< 2.44.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F019743-47B3-4552-BE77-AFD92A153FA7", "versionEndExcluding": "2.44.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0."}, {"lang": "es", "value": "Frappe Learning Management System (LMS) es un sistema de aprendizaje que ayuda a los usuarios a estructurar su contenido. Previo a la versi\u00f3n 2.44.0, se identific\u00f3 un problema de seguridad en Frappe Learning, donde usuarios no autorizados pudieron acceder a la lista completa de estudiantes matriculados (por correo electr\u00f3nico) en lotes. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 2.44.0."}], "id": "CVE-2026-26031", "lastModified": "2026-06-17T10:25:37.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26031", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T15:40:10.774179Z", "version": "2.0.3"}}]}, "published": "2026-02-11T22:15:52.540", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/frappe/lms/releases/tag/v2.44.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.44.0)"}}], "product": "frappe_lms", "vendor": "frappe"}], "analysis": {"en": {"generated_at": "2026-04-17T20:08:51.725510+00:00", "value": {"mitigation_remediation": ["Upgrade Frappe LMS to version 2.44.0 or newer, which removes the authorization flaw.", "Ensure the application\u2019s role\u2011based permissions for the batch enrollment API are configured so that only authenticated users with the appropriate role can access student lists.", "If an immediate upgrade is not possible, consider temporarily disabling public endpoints that expose batch student information until the fix can be applied."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized users can access the full list of batch enrolled students, exposing private email addresses and sensitive user data."}, "threat_synthesis": {"affected_systems": "The affected product is the Frappe Learning Management System (LMS) from the vendor frappe:lms. Versions prior to 2.44.0 are impacted, including all releases 2.43.x and earlier. No other vendors or products were identified.", "description_and_impact": "The vulnerability is an authorization failure that allows unauthenticated or unauthorised users to retrieve the complete list of students enrolled in a batch by their email addresses. This exposes private user information and can enable social engineering or privacy violations. The weakness is categorized as CWE\u2011863.", "risk_and_exploitability": "The CVSS score of 1.3 reflects a low overall impact, but the disclosure of personal emails is a notable privacy concern. The EPSS score is below 1%, indicating a low likelihood of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be unauthenticated or unauthorised access to the LMS application, requiring the attacker to interact with the application\u2019s API or web interface. Since the flaw is an authorization oversight, standard preventive controls such as proper role\u2011based access checks are required to mitigate exploitation."}}}}, "created": "2026-02-12T09:03:11.597530+00:00", "updated": "2026-04-17T20:15:27.001199+00:00", "vendors": ["frappe", "frappe$PRODUCT$frappe_lms"]}