CVE-2025-64705 Overview
CVE-2025-64705 is a broken access control vulnerability in Frappe Learning, an open-source learning management system. Authenticated users could access submissions made by other students by navigating directly to submission URLs. The flaw affects versions from 2.0.0 up to but not including 2.41.0. The maintainers resolved the issue in version 2.41.0 by enforcing proper role checks and redirecting unauthorized direct URL access. The vulnerability is categorized under [CWE-200] Information Exposure.
Critical Impact
Authenticated students can read other students' submission data through direct URL access, exposing coursework and assessment information.
Affected Products
- Frappe Learning versions 2.0.0 through 2.40.x
- Deployments of frappe:learning component prior to 2.41.0
- Self-hosted and managed Frappe LMS instances on affected versions
Discovery Timeline
- 2025-11-12 - CVE-2025-64705 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64705
Vulnerability Analysis
Frappe Learning exposes student submission records through predictable URL endpoints. Prior to version 2.41.0, the application failed to validate whether the requesting user owned the submission or held an instructor role. Any authenticated user who could construct or guess a submission URL could retrieve another student's submitted content. This behavior aligns with [CWE-200] Information Exposure and reflects a missing authorization check on a read path.
Exploitation requires only low-privilege authenticated access over the network. No user interaction is needed, and the attack complexity is minimal since submission URLs follow a predictable structure.
Root Cause
The root cause is missing role-based access control on submission view routes. The application resolved submission records by identifier without confirming that the requesting principal was either the submission owner or an authorized evaluator. The fix in 2.41.0 introduces role enforcement and a redirect when a user reaches a submission URL directly without proper entitlement.
Attack Vector
An authenticated user with a standard student account browses to a submission URL belonging to another user. The server returns the submission content instead of rejecting the request. Attackers can iterate through submission identifiers to enumerate submissions across a course cohort. No exploit code is publicly available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the Frappe LMS GitHub Security Advisory GHSA-qrvv-6g7r-g3v8 for maintainer details.
Detection Methods for CVE-2025-64705
Indicators of Compromise
- Repeated HTTP GET requests to submission endpoints from a single authenticated session across many different submission identifiers.
- Access log entries showing a student account viewing submission resources tied to other user IDs.
- Sequential or scripted enumeration patterns targeting submission URL paths.
Detection Strategies
- Audit web server and application logs for cross-user access to submission routes prior to upgrading to 2.41.0.
- Correlate authenticated session identifiers with the owner IDs of accessed submission records to surface mismatches.
- Alert on high request volume to submission endpoints from non-instructor accounts.
Monitoring Recommendations
- Enable verbose access logging on the Frappe LMS reverse proxy and retain logs for retrospective review.
- Monitor for unusual URL enumeration patterns using web application firewall (WAF) rate-limiting telemetry.
- Track authentication events tied to submission endpoint access to identify suspicious accounts.
How to Mitigate CVE-2025-64705
Immediate Actions Required
- Upgrade Frappe Learning to version 2.41.0 or later on all environments.
- Review historical access logs for evidence of cross-user submission access.
- Rotate credentials for any accounts observed enumerating submission URLs.
Patch Information
The maintainers fixed the issue in Frappe Learning 2.41.0 by adding proper role enforcement and redirecting unauthorized direct URL access. Details are published in the GitHub Security Advisory GHSA-qrvv-6g7r-g3v8.
Workarounds
- Restrict LMS access to trusted user populations until the upgrade is applied.
- Apply a reverse-proxy rule that blocks non-instructor accounts from submission endpoints belonging to other users where feasible.
- Temporarily disable public student enrollment on affected instances to reduce the attacker population.
# Upgrade Frappe Learning using bench
bench get-app --branch main lms
bench --site your-site.local install-app lms
bench update --apps lms
bench --site your-site.local migrate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
