CVE-2025-62778: Frappe Learning Auth Bypass Vulnerability

CVE-2025-62778 Overview

CVE-2025-62778 is an access control weakness in Frappe Learning, an open source learning management system (LMS). In version 2.39.1 and earlier, students could reach the Quiz Form directly by navigating to its URL. The application relied on client-side routing rather than server-enforced role checks, allowing users with the student role to view quiz authoring functionality intended for moderators and instructors. The issue is tracked under CWE-425 (Direct Request / Forced Browsing).

Critical Impact
Authenticated low-privilege users could access Quiz Form pages restricted to moderators and instructors, exposing course authoring interfaces.

Affected Products

Frappe Learning (frappe/lms) versions up to and including 2.39.1
Deployments exposing the LMS frontend to authenticated student accounts
Self-hosted and hosted Frappe LMS instances prior to the patched commit

Discovery Timeline

2025-10-27 - CVE-2025-62778 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62778

Vulnerability Analysis

The flaw is a forced browsing issue in the Frappe LMS Vue frontend. The Quiz Form components did not verify that the requesting user held the Moderator or Course Instructor role before rendering. Any authenticated student who possessed or guessed the Quiz Form URL could load the interface and interact with quiz authoring controls.

The root cause lies in missing role-based authorization checks on the Quiz Form route and its supporting components in frontend/src/components/Modals/Question.vue and frontend/src/pages/CourseForm.vue. Route protection was implicit rather than enforced through explicit permission checks tied to the current session's roles.

Exploitation requires only a valid authenticated session and knowledge of the Quiz Form URL. No user interaction from a privileged account is needed, and no special network position is required beyond normal HTTPS access to the LMS.

Root Cause

The frontend components rendered the Quiz Form based on navigation rather than an authorization decision. Server-side and role-based access controls did not gate the Quiz Form endpoints, so any authenticated request satisfied the check.

Attack Vector

An authenticated student browses to the Quiz Form URL directly, bypassing UI navigation that would normally hide the option. Because there was no server or role-side denial, the form loads within the student's session.

The fix restricts the Quiz Form components to users holding moderator or instructor roles. Below are excerpts from the upstream patch:

text

// frontend/src/components/Modals/Question.vue
 	Button,
 	toast,
 } from 'frappe-ui'
-import { computed, watch, reactive, ref, inject } from 'vue'
+import { watch, reactive, ref, inject } from 'vue'
 import Link from '@/components/Controls/Link.vue'
 import { useOnboarding } from 'frappe-ui/frappe'

text

// frontend/src/pages/CourseForm.vue
 <script setup>
 import {
 	Breadcrumbs,
-	call,
 	TextEditor,
 	Button,
 	createResource,

Source: frappe/lms commit 8749e21

Detection Methods for CVE-2025-62778

Indicators of Compromise

Access log entries showing student-role accounts requesting Quiz Form routes such as /quiz/* or the CourseForm quiz question endpoints.
Unexpected GET requests to frontend/src/pages/CourseForm.vue-backed routes from non-instructor sessions.
Repeated URL-guessing patterns against /lms/* quiz paths originating from a single authenticated session.

Detection Strategies

Correlate Frappe LMS web server logs with the user role field to flag Quiz Form access by accounts lacking Moderator or Course Instructor roles.
Enable Frappe audit logging on Quiz and Question DocTypes and alert on read events performed by student accounts.
Baseline normal instructor traffic to the Quiz Form and alert on deviations by role or session.

Monitoring Recommendations

Forward Frappe LMS application logs and reverse proxy access logs to a centralized SIEM for role-versus-URL correlation.
Track authentication events alongside quiz-related URL access to detect forced browsing attempts.
Alert on any HTTP 200 responses to Quiz Form URLs for principals whose role list does not include instructor or moderator.

How to Mitigate CVE-2025-62778

Immediate Actions Required

Upgrade Frappe Learning to a version that includes commit 8749e21744547ae32f729bde05c854113e126750 or later.
Review Quiz and Question DocType permissions in the Frappe role editor to confirm only Moderator and Course Instructor roles have read access.
Audit recent Quiz Form access by student accounts and reset quizzes if unauthorized viewing is suspected.

Patch Information

The upstream fix restricts Quiz Form access to users with the Moderator or Course Instructor role. See the GitHub Security Advisory GHSA-8xvv-6v89-xxgx and the patch commit 8749e21 for details. Administrators should pull the latest frappe/lms release and rebuild the frontend assets.

Workarounds

Restrict access to Quiz Form routes at the reverse proxy or web application firewall (WAF) layer, allowing only authenticated instructor IP ranges or session cookies with instructor claims.
Remove or unpublish quiz drafts from environments that cannot be patched immediately to reduce exposure.
Tighten DocType-level permissions in Frappe so that student roles cannot read Quiz or Question records regardless of URL.

bash

# Example nginx snippet restricting quiz form routes to authenticated instructor sessions
location ~ ^/lms/quiz-form/ {
    if ($cookie_user_role !~* "(Moderator|Course Instructor)") {
        return 403;
    }
    proxy_pass http://frappe_backend;
}