CVE-2026-26977: 
NixOS vulnerability analysis and mitigation

CVE-2026-26977 is an improper access control vulnerability in Frappe Learning Management System (LMS) that allows unauthorized users to access details of unpublished courses via API endpoints. It affects Frappe LMS versions 2.0.0 through 2.44.0, with a fix introduced in version 2.45.0. The vulnerability was published on February 20, 2026, and the security advisory was originally published by the Frappe team on February 16, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified under CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization). Specifically, certain API endpoints in Frappe LMS failed to enforce authorization checks to verify whether a requesting user had permission to view unpublished course content. An unauthenticated attacker can send network requests directly to these API endpoints to retrieve course details — including content, structure, and metadata — that were intended to remain private prior to publication. The fix in version 2.45.0 adds a check so that if a course is unpublished, only admins and enrolled students are permitted to retrieve its details (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to read confidential details of unpublished courses, including course content, structure, and associated metadata that course authors intended to keep private. The impact is limited to confidentiality — there is no integrity or availability impact — and does not facilitate lateral movement or code execution. Organizations using Frappe LMS to develop proprietary or sensitive educational content prior to publication are most at risk of premature content disclosure (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any network-accessible attacker if the LMS is internet-facing. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Frappe LMS instances running versions 2.0.0–2.44.0 using search engines (e.g., Shodan, Censys) or by browsing to the LMS URL and checking version indicators.
2. Identify API endpoints: Review Frappe LMS documentation or source code to identify API endpoints that return course details (e.g., endpoints under /api/method/lms.* or similar Frappe REST API paths).
3. Send unauthenticated request: Issue an HTTP GET request to the relevant course detail API endpoint without any authentication token or session cookie, specifying the name or ID of a target course.
4. Retrieve unpublished course data: If the target course is unpublished and the instance is unpatched, the API will return course details — including content, structure, and metadata — without enforcing authorization checks (GitHub Advisory).

• Network: Unusual unauthenticated HTTP GET requests to Frappe LMS API endpoints (e.g., /api/method/lms.*) for course resources, particularly from external or unknown IP addresses.
• Logs: Web server or application access logs showing repeated API calls to course-related endpoints without associated session tokens or authentication headers, especially for courses not yet published.
• Application Logs: Frappe framework logs showing API access to unpublished course records by guest or anonymous users.

The primary remediation is to upgrade Frappe LMS to version 2.45.0 or later, which enforces proper authorization checks on course detail API endpoints, restricting access to unpublished courses to admins and enrolled students only. For organizations unable to upgrade immediately, a recommended interim workaround is to restrict access to LMS API endpoints via network controls (e.g., firewall rules, VPN requirements) or Web Application Firewall (WAF) rules that limit course-related API endpoint access to authenticated users. Exposing the LMS only to trusted internal networks further reduces risk until patching is feasible (GitHub Advisory).

The vulnerability was reported to the Frappe team by a researcher identified as "filime" and was addressed promptly with the 2.45.0 release. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).