Is CVE-2026-39385 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-39385

Description

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.