CVE-2025-66581: Frappe LMS Authorization Bypass Vulnerability

CVE-2025-66581 Overview

CVE-2025-66581 is a broken access control vulnerability in Frappe Learning Management System (LMS) affecting versions prior to 2.41.0. The flaw resides in server-side authorization logic across multiple API endpoints. Affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server. Authenticated low-privileged users, such as students, can invoke APIs reserved for instructors or administrators. The issue is tracked as CWE-863: Incorrect Authorization and is fixed in release 2.41.0.

Critical Impact
Authenticated users with student-level roles can perform instructor or administrator operations by calling backend APIs directly, bypassing UI-enforced role restrictions.

Affected Products

Frappe Learning Management System (LMS) versions prior to 2.41.0
Component: frappe:learning
Deployments exposing the LMS API endpoints to authenticated users

Discovery Timeline

2025-12-05 - CVE-2025-66581 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2025-66581

Vulnerability Analysis

Frappe LMS enforces role separation between students, instructors, and administrators at the user interface layer. Multiple backend endpoints trust that the UI will prevent unauthorized role actions. When a client sends a direct API request, the server does not re-validate whether the authenticated principal holds the required role. As a result, a student-level account can issue API calls that create, modify, or access resources intended only for elevated roles. The scope spans multiple features of the LMS, meaning the impact depends on which endpoints an attacker chooses to invoke.

Root Cause

The root cause is incorrect authorization [CWE-863]. Permission checks exist only on the client side or in UI templates. Server-side request handlers process incoming calls without verifying that the caller's role matches the operation. This is a classic case of trusting the client to enforce security boundaries that must be enforced on the server.

Attack Vector

Exploitation requires an authenticated session with any valid role, including the lowest-privileged student role. An attacker enumerates LMS API endpoints by inspecting browser traffic or public documentation. They then craft HTTP requests to privileged endpoints using their existing session credentials. No special tooling, elevated network position, or user interaction is required beyond holding valid credentials. See the GitHub Security Advisory GHSA-2ch7-c74m-432m for additional technical context.

No verified public proof-of-concept code is available for this issue.

Detection Methods for CVE-2025-66581

Indicators of Compromise

API requests to instructor or administrator endpoints originating from accounts holding only the student role
Unexpected creation, modification, or deletion of courses, batches, or assessments by non-instructor accounts
Access patterns from a single authenticated user that span multiple privileged resource types in a short window

Detection Strategies

Correlate authenticated user role metadata against the endpoint invoked in LMS web server access logs
Build allowlists of expected endpoints per role and alert on deviations
Review Frappe audit trails for administrative actions attributed to non-administrator accounts

Monitoring Recommendations

Enable verbose request logging on the LMS application tier, including authenticated user, role, and endpoint path
Forward LMS and reverse-proxy logs to a centralized analytics platform for role-versus-action correlation
Monitor for high-volume API enumeration from newly registered or low-reputation student accounts

How to Mitigate CVE-2025-66581

Immediate Actions Required

Upgrade Frappe Learning Management System to version 2.41.0 or later
Audit existing user roles and remove accounts that should not retain access
Review historical API logs for unauthorized actions performed prior to patching

Patch Information

The vulnerability is fixed in Frappe Learning version 2.41.0. The maintainers added server-side permission enforcement to the affected endpoints. Refer to the GitHub Security Advisory GHSA-2ch7-c74m-432m for release details.

Workarounds

Restrict LMS access to trusted authenticated users until the patch is applied
Place the LMS behind a reverse proxy that denies direct access to administrative API paths for non-instructor sessions
Temporarily disable self-service account registration to limit the pool of potential attackers

bash

# Upgrade Frappe Learning to the fixed release
bench get-app --branch main lms https://github.com/frappe/lms
bench --site your-site.local install-app lms
bench --site your-site.local migrate
bench update --apps lms --reset
# Verify installed version is 2.41.0 or later
bench --site your-site.local list-apps