CVE-2026-39385: Frappe LMS Auth Bypass Vulnerability

CVE-2026-39385 Overview

CVE-2026-39385 is an authentication bypass vulnerability in Frappe LMS, an open source learning management system. The flaw affects versions 2.51.0 and earlier. An authenticated user can bypass payment validation for paid courses by supplying an unrelated batch during enrollment. The application failed to verify that the submitted batch was actually linked to the target course, allowing enrollment without payment. The issue is categorized under [CWE-288] Authentication Bypass Using an Alternate Path or Channel. Frappe released version 2.52.0, which enforces validation that the batch belongs to the course being enrolled in.

Critical Impact
Authenticated attackers can enroll in paid Frappe LMS courses without completing payment, causing direct revenue loss and unauthorized access to restricted course content.

Affected Products

Frappe LMS versions 2.51.0 and earlier
Instances exposing course enrollment endpoints to authenticated users
Deployments monetizing courses through batch-based paid enrollment

Discovery Timeline

2026-07-20 - CVE-2026-39385 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-39385

Vulnerability Analysis

The vulnerability stems from missing relational validation in the course enrollment workflow. Frappe LMS uses Batch records to group learners and associate them with specific courses. Paid courses require users to purchase access, typically tied to a batch that carries the payment context.

In version 2.51.0 and earlier, the enrollment logic accepts a batch identifier from the user without verifying that the batch is linked to the course being enrolled. An attacker with a valid low-privilege account can submit a batch reference belonging to a free or unrelated course while enrolling in a paid course. The server processes the enrollment and grants access to the paid content.

The network attack vector requires only low-privilege authentication and no user interaction. The impact is limited to confidentiality of course content and monetary loss for course providers, with no integrity or availability impact on the platform itself.

Root Cause

The root cause is a broken business logic check in the enrollment handler. The function verifies that the batch exists and that the course exists, but omits a foreign-key style check confirming the batch belongs to the course. This missing constraint allows the payment gate tied to the batch to be substituted with an unrelated batch that carries no payment requirement.

Attack Vector

An attacker authenticates to a Frappe LMS instance with any standard user account. The attacker identifies a paid course and any free or already accessible batch on the platform. The attacker then issues an enrollment request specifying the paid course together with the unrelated batch identifier. The server accepts the mismatched pair and completes enrollment.

Exploitation code is not required. The attack can be reproduced with standard HTTP tooling against the enrollment endpoint. See the GitHub Security Advisory for the maintainer's technical description.

Detection Methods for CVE-2026-39385

Indicators of Compromise

Enrollment records where the associated batch field references a batch not linked to the enrolled course.
Users appearing in paid course rosters without a corresponding payment or invoice record.
Enrollment API requests submitting batch identifiers that historically belong to unrelated courses.

Detection Strategies

Run database audits joining enrollment, batch, and course tables to surface mismatched relationships.
Review web server logs for POST requests to Frappe LMS enrollment endpoints followed by access to premium course content without preceding payment events.
Correlate payment gateway transaction logs with enrollment timestamps to identify enrollments lacking financial records.

Monitoring Recommendations

Alert on new enrollments in paid courses where no payment transaction is logged within a defined window.
Track anomalous enrollment volume from individual accounts targeting multiple paid courses.
Log and review all enrollment API calls, including submitted batch and course parameters, for post-incident analysis.

How to Mitigate CVE-2026-39385

Immediate Actions Required

Upgrade Frappe LMS to version 2.52.0 or later, which enforces batch-to-course validation.
Audit existing enrollments in paid courses to identify and revoke unauthorized access granted through mismatched batches.
Reconcile payment records with course rosters and pursue payment or removal for any unpaid enrollees.

Patch Information

The vulnerability is patched in Frappe LMS 2.52.0. The fix adds a validation step during enrollment that confirms the supplied batch is linked to the target course. Administrators should apply the update through their standard Frappe deployment process and verify the version after upgrade. Full details are available in the Frappe LMS GitHub Security Advisory GHSA-c4xh-2rcm-6mgc.

Workarounds

Restrict access to the enrollment endpoint via a reverse proxy rule if immediate patching is not possible.
Temporarily disable self-service enrollment for paid courses and require administrator approval.
Add a custom server-side hook that rejects enrollment requests where the batch's course field does not match the submitted course identifier.

bash

# Upgrade Frappe LMS to the patched release
bench get-app --branch version-2.52.0 lms https://github.com/frappe/lms
bench --site <your-site> install-app lms
bench --site <your-site> migrate
bench restart