CVE-2026-39415: CWE-602: Client-Side Enforcement of Server-Side Security in frappe lms
Frappe Learning Management System (LMS) versions prior to 2.46.0 have a vulnerability where quiz scores are calculated and enforced on the client side. This allows students to modify their quiz scores using browser developer tools before submission, compromising the integrity of quiz results. The vulnerability does not allow unauthorized access to other users' data or privilege escalation. The issue is fixed in version 2.46.0.
AI Analysis
Technical Summary
CVE-2026-39415 is a medium severity vulnerability in Frappe LMS before version 2.46.0. The system relies on client-side enforcement of quiz scores, which can be manipulated by users before submission. This is a CWE-602 issue where server-side security enforcement is lacking, allowing modification of quiz results by the client. The vulnerability affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. The fix is implemented in version 2.46.0.
Potential Impact
The vulnerability impacts the integrity of quiz results by allowing students to alter their scores before submission. It does not lead to unauthorized access, privilege escalation, or exposure of confidential information. The academic reliability of quiz outcomes is undermined, but no other system components or user data are affected.
Mitigation Recommendations
Upgrade Frappe LMS to version 2.46.0 or later, where this vulnerability is fixed. Since the issue is resolved in this version, applying the official update fully mitigates the risk. No additional mitigations are indicated.
CVE-2026-39415: CWE-602: Client-Side Enforcement of Server-Side Security in frappe lms
Description
Frappe Learning Management System (LMS) versions prior to 2.46.0 have a vulnerability where quiz scores are calculated and enforced on the client side. This allows students to modify their quiz scores using browser developer tools before submission, compromising the integrity of quiz results. The vulnerability does not allow unauthorized access to other users' data or privilege escalation. The issue is fixed in version 2.46.0.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39415 is a medium severity vulnerability in Frappe LMS before version 2.46.0. The system relies on client-side enforcement of quiz scores, which can be manipulated by users before submission. This is a CWE-602 issue where server-side security enforcement is lacking, allowing modification of quiz results by the client. The vulnerability affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. The fix is implemented in version 2.46.0.
Potential Impact
The vulnerability impacts the integrity of quiz results by allowing students to alter their scores before submission. It does not lead to unauthorized access, privilege escalation, or exposure of confidential information. The academic reliability of quiz outcomes is undermined, but no other system components or user data are affected.
Mitigation Recommendations
Upgrade Frappe LMS to version 2.46.0 or later, where this vulnerability is fixed. Since the issue is resolved in this version, applying the official update fully mitigates the risk. No additional mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-07T00:23:30.595Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d6bc281cc7ad14daadead7
Added to database: 04/08/2026, 20:35:52 UTC
Last enriched: 04/16/2026, 12:22:21 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 263
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.