CVE-2026-26031: Frappe Learning Information Disclosure

CVE-2026-26031 Overview

CVE-2026-26031 is a Broken Access Control vulnerability in Frappe Learning Management System (LMS), an open-source learning platform that helps users structure and deliver educational content. Prior to version 2.44.0, a security flaw allowed unauthorized users to access the complete list of enrolled students (by email) in batches, exposing sensitive user information to attackers with low-level privileges.

Critical Impact
Unauthorized disclosure of student email addresses enables targeted phishing campaigns, social engineering attacks, and potential privacy violations affecting educational institutions using Frappe LMS.

Affected Products

Frappe Learning Management System (LMS) versions prior to 2.44.0
Frappe Learning deployments with batch enrollment features enabled
Self-hosted and cloud-hosted Frappe LMS instances

Discovery Timeline

2026-02-11 - CVE-2026-26031 published to NVD
2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26031

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), where the application fails to properly verify that authenticated users have the necessary permissions to access student enrollment data. The flaw exists in the batch enrollment functionality, which allows low-privileged users to enumerate and retrieve email addresses of all students enrolled in course batches.

The attack requires network access and low-privilege authentication, meaning an attacker must have at least a basic user account on the Frappe LMS platform. Once authenticated, the attacker can exploit the improper access control to retrieve sensitive student information that should only be accessible to instructors or administrators.

Root Cause

The root cause of this vulnerability is insufficient authorization checks in the API endpoints or functions responsible for retrieving batch enrollment data. The application fails to properly validate whether the requesting user has the appropriate role or permissions to view student enrollment lists, allowing any authenticated user to access this sensitive information.

Attack Vector

The attack is conducted over the network by an authenticated low-privilege user. The attacker exploits the lack of proper authorization controls to access batch enrollment endpoints or functions that return student email addresses. This information disclosure does not require any user interaction and can be exploited programmatically to harvest large amounts of student data.

The vulnerability allows attackers to enumerate enrolled students across multiple batches, potentially exposing thousands of email addresses in educational environments with large user bases. This data could be leveraged for spam campaigns, credential stuffing attacks, or targeted phishing operations against students and educational institutions.

Detection Methods for CVE-2026-26031

Indicators of Compromise

Unusual API requests to batch enrollment endpoints from low-privilege user accounts
High-volume queries to student enrollment data outside normal application usage patterns
Access logs showing unauthorized users retrieving batch member lists
Anomalous data export activities targeting student information

Detection Strategies

Monitor API access logs for requests to enrollment-related endpoints by non-administrative users
Implement alerting on bulk data retrieval patterns from student enrollment functions
Review application audit logs for access to batch membership data by unauthorized roles
Deploy web application firewalls with rules to detect enumeration attacks against user data endpoints

Monitoring Recommendations

Enable detailed logging for all enrollment-related API calls including user context and response sizes
Set up alerts for any access to student data by users without instructor or administrator roles
Implement rate limiting on enrollment data endpoints to prevent bulk harvesting
Regularly audit user access patterns to batch enrollment functionality

How to Mitigate CVE-2026-26031

Immediate Actions Required

Upgrade Frappe Learning Management System to version 2.44.0 or later immediately
Audit access logs to determine if this vulnerability has been exploited
Review user accounts for any suspicious activity or unauthorized data access
Notify affected students if unauthorized access to their email addresses is confirmed

Patch Information

Frappe has released version 2.44.0 which addresses this vulnerability by implementing proper authorization checks on batch enrollment data access. The security fix ensures that only users with appropriate permissions (instructors, administrators) can access student enrollment information.

For detailed patch information, refer to the GitHub Release v2.44.0 and the GitHub Security Advisory GHSA-3gw9-gwjm-vcq5.

Workarounds

Restrict network access to the Frappe LMS instance to trusted networks only until patching is complete
Implement additional access controls at the reverse proxy or WAF level to block unauthorized enrollment data requests
Temporarily disable batch enrollment features if immediate patching is not possible
Review and restrict user role assignments to minimize the number of accounts that could potentially exploit this vulnerability

bash

# Update Frappe LMS to patched version
bench update --apps lms
bench --site your-site.local migrate
bench --site your-site.local clear-cache