CVE-2026-39415

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-39415

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39415.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-39415

Aliases

GHSA-9573-68xq-hwrx

Published

2026-04-08T20:07:45.729Z

Modified

2026-07-08T08:02:05.222388382Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

Details

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.46.0, a vulnerability has been identified in Frappe Learning where quiz scores can be modified by students before submission. The application currently relies on client-side calculated scores, which can be altered using browser developer tools prior to sending the submission request. While this does not allow modification of other users’ data or privilege escalation, it compromises the integrity of quiz results and undermines academic reliability. This issue affects data integrity but does not expose confidential information or allow unauthorized access to other accounts. This vulnerability is fixed in 2.46.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-602"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39415.json"
}

References

Affected packages

Git / github.com/frappe/lms

Affected ranges

Type

GIT

Repo

https://github.com/frappe/lms

Events

Introduced

63d613a88e10e23851bc6d76d0daa2de0c753c21

Fixed

5933a59a1416da9c9d64b58c406f347ce653844b

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.46.0"
        },
        {
            "introduced": "2.0.0"
        }
    ],
    "cpe": "cpe:2.3:a:frappe:learning:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39415.json"