CVE-2026-26031: 
NixOS vulnerability analysis and mitigation

CVE-2026-26031 is an incorrect authorization vulnerability in Frappe Learning Management System (LMS) that allows unauthenticated users to access the full list of enrolled students (by email) across batches. It affects Frappe LMS versions 2.0.0 through 2.43.x and was disclosed on February 11, 2026, with a fix released in version 2.44.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an incorrect authorization check (CWE-863) in the batch enrollment student list endpoint, which failed to verify whether the requesting user had appropriate privileges before returning student data. An unauthenticated remote attacker can send a network request to the affected endpoint and receive the full list of enrolled student email addresses for any batch, without requiring any credentials or user interaction. The fix restricts the student list response to users holding Moderator or Batch Evaluator roles, returning an empty list to all other users (GitHub Advisory).

Successful exploitation allows any unauthenticated attacker to harvest email addresses of enrolled students across all LMS batches, resulting in a confidentiality breach of student enrollment data. While there is no integrity or availability impact, the exposed email addresses could be leveraged for targeted phishing campaigns, social engineering attacks, or spam targeting students and affiliated organizations. The reputational and compliance risks to institutions using the affected LMS versions may be significant, particularly where student privacy regulations apply (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable if targeted, though the limited impact scope reduces overall attacker incentive (Feedly).

1. Reconnaissance: Identify publicly accessible Frappe LMS instances running versions 2.0.0 through 2.43.x using search engines, Shodan, or by browsing known LMS deployments.
2. Identify batch enrollment endpoint: Locate the API endpoint responsible for returning batch-enrolled student lists (e.g., the batch student list API within the Frappe LMS application).
3. Send unauthenticated request: Issue an HTTP GET request to the batch student list endpoint without any authentication headers or session cookies.
4. Harvest student emails: Parse the API response, which returns the full list of enrolled student email addresses for the targeted batch, enabling bulk email harvesting for downstream phishing or social engineering campaigns (GitHub Advisory).

• Network: Unusual or repeated unauthenticated HTTP GET requests to batch student list API endpoints from external or unknown IP addresses.
• Logs: Web server or application access logs showing requests to batch enrollment/student list endpoints with no associated authenticated session, particularly in high volume or from a single source IP.
• Application Logs: Absence of user session tokens in requests to endpoints that should require authorization, combined with successful 200 OK responses returning student data.

The primary remediation is to upgrade Frappe LMS to version 2.44.0 or later, which restricts the student list endpoint to users with Moderator or Batch Evaluator roles and returns an empty list to all other users. No configuration-based workaround has been published; upgrading is the only supported fix. Organizations should also review access logs for signs of unauthorized enumeration and monitor for phishing activity targeting enrolled students (GitHub Advisory, GitHub Release).