CVE-2026-26977: Frappe LMS Information Disclosure Issue

CVE-2026-26977 Overview

Frappe Learning Management System (LMS) is a learning platform designed to help users structure and manage educational content. A broken access control vulnerability has been identified in versions 2.44.0 and below that allows unauthorized users to access details of unpublished courses via API endpoints. This information disclosure vulnerability could expose sensitive course materials, pricing information, or other confidential data intended for internal review before publication.

Critical Impact

Unauthorized users can bypass access controls to retrieve details of unpublished courses through the Frappe LMS API, potentially exposing confidential educational content and course metadata.

Affected Products

• Frappe Learning Management System versions 2.44.0 and below
• All installations of Frappe LMS using default API configurations

Discovery Timeline

• 2026-02-20 - CVE-2026-26977 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26977

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), indicating that the Frappe LMS application fails to properly enforce authorization checks on API endpoints that return course information. The flaw allows unauthenticated or low-privileged users to query API endpoints and retrieve data about courses that have not yet been published.

The attack can be performed remotely over the network without requiring any user interaction or special privileges. While the vulnerability allows read access to confidential information, it does not permit modification of data or compromise system availability.

Root Cause

The root cause of this vulnerability is insufficient access control validation on API endpoints responsible for serving course data. The application does not properly verify whether a course is in a published state before returning its details to the requesting user, nor does it adequately check the requester's authorization level to view unpublished content.

Attack Vector

An attacker can exploit this vulnerability by sending API requests to the Frappe LMS endpoints that handle course data retrieval. By enumerating course identifiers or manipulating API parameters, an attacker can retrieve information about courses that are marked as unpublished or draft status.

The vulnerability is exploitable over the network with low attack complexity. No authentication or special privileges are required to exploit this flaw, making it accessible to any user who can reach the Frappe LMS API endpoints.

The vulnerability mechanism involves API endpoints that return course details without verifying the publication status of the course or the authorization level of the requester. Technical details are available in the GitHub Security Advisory.

Detection Methods for CVE-2026-26977

Indicators of Compromise

• Unusual API request patterns targeting course endpoints with sequential or enumerated course identifiers
• API requests from unauthenticated sessions attempting to access course detail endpoints
• Log entries showing successful retrieval of unpublished course data by non-administrative users
• Elevated volume of API requests to course-related endpoints from single IP addresses

Detection Strategies

• Monitor API access logs for requests to course detail endpoints that return data for courses with published: false status
• Implement anomaly detection for API request patterns that indicate enumeration attempts
• Configure web application firewall (WAF) rules to flag requests accessing course endpoints without proper authentication tokens
• Review application logs for unauthorized access attempts to course management APIs

Monitoring Recommendations

• Enable detailed logging for all Frappe LMS API endpoints, particularly those handling course data
• Set up alerts for failed authorization attempts on course-related endpoints
• Monitor for bulk API requests that could indicate data harvesting activities
• Implement rate limiting on course detail API endpoints to slow potential enumeration attacks

How to Mitigate CVE-2026-26977

Immediate Actions Required

• Upgrade Frappe LMS to version 2.45.0 or later when released, which includes a fix for this vulnerability
• Review current Frappe LMS deployment for any signs of unauthorized access to unpublished course data
• Implement network-level access controls to restrict API access to trusted sources where possible
• Audit API access logs for evidence of exploitation attempts

Patch Information

A fix for this vulnerability is planned for inclusion in Frappe LMS version 2.45.0. Organizations should monitor the official Frappe LMS repository and GitHub Security Advisory for release announcements. Once available, upgrading to the patched version is the recommended remediation approach.

Workarounds

• Implement API gateway or reverse proxy rules to restrict access to course detail endpoints
• Add custom middleware to validate course publication status before returning data
• Restrict network access to the Frappe LMS API to internal networks or VPN-connected users only
• Temporarily disable public access to course listing and detail APIs until the patch is applied

# Example: Restrict API access via nginx configuration
# Add to your Frappe LMS nginx server block
location /api/resource/LMS Course {
    # Restrict to internal networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Alternatively, require authentication header
    # if ($http_authorization = "") {
    #     return 403;
    # }
    
    proxy_pass http://frappe_backend;
}