CVE-2026-26031: Frappe Learning Information Disclosure

CVE-2026-26031 Overview

CVE-2026-26031 is a Broken Access Control vulnerability in Frappe Learning Management System (LMS), an open-source learning platform that helps users structure and deliver educational content. Prior to version 2.44.0, a security flaw allowed unauthorized users to access the complete list of enrolled students (by email) in batches, exposing sensitive user information to attackers with low-level privileges.

Critical Impact

Unauthorized disclosure of student email addresses enables targeted phishing campaigns, social engineering attacks, and potential privacy violations affecting educational institutions using Frappe LMS.

Affected Products

• Frappe Learning Management System (LMS) versions prior to 2.44.0
• Frappe Learning deployments with batch enrollment features enabled
• Self-hosted and cloud-hosted Frappe LMS instances

Discovery Timeline

• 2026-02-11 - CVE-2026-26031 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26031

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), where the application fails to properly verify that authenticated users have the necessary permissions to access student enrollment data. The flaw exists in the batch enrollment functionality, which allows low-privileged users to enumerate and retrieve email addresses of all students enrolled in course batches.

The attack requires network access and low-privilege authentication, meaning an attacker must have at least a basic user account on the Frappe LMS platform. Once authenticated, the attacker can exploit the improper access control to retrieve sensitive student information that should only be accessible to instructors or administrators.

Root Cause

The root cause of this vulnerability is insufficient authorization checks in the API endpoints or functions responsible for retrieving batch enrollment data. The application fails to properly validate whether the requesting user has the appropriate role or permissions to view student enrollment lists, allowing any authenticated user to access this sensitive information.

Attack Vector

The attack is conducted over the network by an authenticated low-privilege user. The attacker exploits the lack of proper authorization controls to access batch enrollment endpoints or functions that return student email addresses. This information disclosure does not require any user interaction and can be exploited programmatically to harvest large amounts of student data.

The vulnerability allows attackers to enumerate enrolled students across multiple batches, potentially exposing thousands of email addresses in educational environments with large user bases. This data could be leveraged for spam campaigns, credential stuffing attacks, or targeted phishing operations against students and educational institutions.

Detection Methods for CVE-2026-26031

Indicators of Compromise

• Unusual API requests to batch enrollment endpoints from low-privilege user accounts
• High-volume queries to student enrollment data outside normal application usage patterns
• Access logs showing unauthorized users retrieving batch member lists
• Anomalous data export activities targeting student information

Detection Strategies

• Monitor API access logs for requests to enrollment-related endpoints by non-administrative users
• Implement alerting on bulk data retrieval patterns from student enrollment functions
• Review application audit logs for access to batch membership data by unauthorized roles
• Deploy web application firewalls with rules to detect enumeration attacks against user data endpoints

Monitoring Recommendations

• Enable detailed logging for all enrollment-related API calls including user context and response sizes
• Set up alerts for any access to student data by users without instructor or administrator roles
• Implement rate limiting on enrollment data endpoints to prevent bulk harvesting
• Regularly audit user access patterns to batch enrollment functionality

How to Mitigate CVE-2026-26031

Immediate Actions Required

• Upgrade Frappe Learning Management System to version 2.44.0 or later immediately
• Audit access logs to determine if this vulnerability has been exploited
• Review user accounts for any suspicious activity or unauthorized data access
• Notify affected students if unauthorized access to their email addresses is confirmed

Patch Information

Frappe has released version 2.44.0 which addresses this vulnerability by implementing proper authorization checks on batch enrollment data access. The security fix ensures that only users with appropriate permissions (instructors, administrators) can access student enrollment information.

For detailed patch information, refer to the GitHub Release v2.44.0 and the GitHub Security Advisory GHSA-3gw9-gwjm-vcq5.

Workarounds

• Restrict network access to the Frappe LMS instance to trusted networks only until patching is complete
• Implement additional access controls at the reverse proxy or WAF level to block unauthorized enrollment data requests
• Temporarily disable batch enrollment features if immediate patching is not possible
• Review and restrict user role assignments to minimize the number of accounts that could potentially exploit this vulnerability

# Update Frappe LMS to patched version
bench update --apps lms
bench --site your-site.local migrate
bench --site your-site.local clear-cache