CVE-2026-26977 identifies a missing authorization vulnerability in the Frappe LMS product, specifically in versions 2.44.0 and earlier. The flaw allows unauthenticated attackers to retrieve details of unpublished courses through API endpoints that lack proper access control mechanisms. This vulnerability is categorized under CWE-862 (Missing Authorization) and CWE-284 (Improper Access Control), indicating that the system fails to verify whether the requesting user has the necessary permissions before disclosing sensitive course information. The vulnerability is remotely exploitable without any authentication or user interaction, making it accessible to any attacker with network access to the LMS API. The exposed data could include course content, metadata, or other sensitive information intended only for authorized users or internal review. While the CVSS 4.0 base score is 6.9 (medium severity), reflecting the moderate impact on confidentiality and the ease of exploitation, there is no indication of impact on integrity or availability. The vendor plans to release a patch in version 2.45.0 to enforce proper authorization checks on these API endpoints. Until then, affected organizations remain vulnerable to unauthorized data disclosure.

The primary impact of this vulnerability is unauthorized disclosure of unpublished course details, which can compromise confidentiality. For educational institutions, training providers, or enterprises using Frappe LMS, this could lead to premature exposure of proprietary or sensitive course content, undermining competitive advantage or violating privacy policies. Attackers could leverage this information for social engineering, intellectual property theft, or to gain insights into organizational training strategies. Although the vulnerability does not affect system integrity or availability, the breach of confidentiality can damage reputation and trust. Since exploitation requires no authentication and no user interaction, the attack surface is broad, increasing risk especially for publicly accessible LMS deployments. Organizations worldwide using affected versions face potential data leakage until the patch is applied.

1. Upgrade to Frappe LMS version 2.45.0 or later immediately upon release to apply the official fix enforcing proper authorization. 2. Until patching, restrict network access to the LMS API endpoints by implementing firewall rules or network segmentation to limit exposure to trusted users only. 3. Employ Web Application Firewalls (WAF) with custom rules to detect and block unauthorized API requests targeting unpublished course data. 4. Conduct an audit of current unpublished course data exposure and remove or archive sensitive content temporarily if feasible. 5. Monitor API access logs for unusual or unauthorized requests to unpublished course endpoints to detect potential exploitation attempts. 6. Educate LMS administrators on the risk and ensure secure configuration management to prevent similar authorization lapses. 7. Consider implementing additional authentication or token-based access controls at the API layer as a compensating control until the patch is deployed.