{"id":"CVE-2026-61803","aliases":[],"cve":{"records":[{"id":"CVE-2026-61803","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:06:05.618Z","published":"2026-10-30T16:50:08.737Z","modified":"2026-10-30T16:59:19.940Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T16:50:08.737Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:59:19.940Z"}],"references":[{"url":"https://github.com/frappe/lms/security/advisories/GHSA-g5jj-q8m7-359c","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/frappe/lms/commit/1d04f4fd917b62f5dd4442a541280fc40a4178b4","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/frappe/lms/tree/v2.52.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:59:07.241050Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.","score":5.3,"severity":"medium","published":"2026-10-30T16:50:08.737Z","modified":"2026-10-30T16:59:19.940Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"frappe","name":"lms","platforms":[],"versions":[{"version":"< 2.52.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61803"}],"remediation":[],"references":["https://github.com/frappe/lms/security/advisories/GHSA-g5jj-q8m7-359c","https://github.com/frappe/lms/commit/1d04f4fd917b62f5dd4442a541280fc40a4178b4","https://github.com/frappe/lms/tree/v2.52.1"],"sources":[{"name":"CVE","id":"CVE-2026-61803","modified":"2026-10-30T16:59:19.940Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61803"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-30T18:16:27.354Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:20:38.976Z","attemptedAt":"2026-10-30T18:20:38.976Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T18:20:39.040Z","attemptedAt":"2026-10-30T18:20:39.040Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T18:20:39.042Z","attemptedAt":"2026-10-30T18:20:39.042Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T18:20:38.973Z","attemptedAt":"2026-10-30T18:20:38.973Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-61803","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61803","modified":"2026-10-30T17:17:26.917","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T18:20:38.976Z"},{"source":"ENISA EUVD","id":"EUVD-2026-114197","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114197","modified":"Oct 30, 2026, 4:50:08 PM","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T18:20:39.042Z"}],"aiSummary":null}