CVE-2026-39385 is an authentication bypass vulnerability (CWE-288) in Frappe LMS, an open source learning management system. In versions up to and including 2.51.0, users could enroll in courses without proper payment validation by associating their enrollment with an unrelated batch. This flaw allows bypassing intended access controls related to course enrollment. The vulnerability was addressed in version 2.52.0 by adding validation to ensure that the batch used for enrollment is linked to the course, preventing unauthorized bypass of payment checks.

Successful exploitation allows a user with limited privileges to bypass payment validation and enroll in courses without paying, potentially leading to unauthorized access to paid course content. The CVSS 4.0 base score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Upgrade Frappe LMS to version 2.52.0 or later, where the vulnerability has been patched by enforcing batch-to-course linkage validation during enrollment. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's versioning information.