Vulnerability Report

CVE-2026-26031

Title: Information disclosure in Frappe Learning Management System (LMS)

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-26031.

CWE Category CWE-863

Published Date Feb 11, 2026

Modified Date Feb 12, 2026

Exploit Status Not Found

Score 1.3 CVSS v4.0

Exploit Probability (EPSS)

0.18%

Vulnerability Summary

CVE-2026-26031: Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.

Impacted Vendors

frappe 1

Reference Links

https://github.com/frappe/lms/releases/tag/v2.44.0 https://github.com/frappe/lms/security/advisories/GHSA-3gw9-gwjm-vcq5

CVSS v4.0

Source Entity [email protected]

Severity LOW

1.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.3