CVE-2025-64705 - Frappe user was able to access the submission of other students · CoreCVE

Back Back to CVE browser

LOW

Frappe user was able to access the submission of other students

Published Nov 12, 2025

1.3

LOW

CVSS 4.0

EPSS 0.21%

Description

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.

Affected products

Vendor Frappe Product Lms Default
n/a
- Version
  >= 2.0.0, < 2.41.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
>= 2.0.0, < 2.41.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

https://github.com/frappe/lms/security/advisories/GHSA-qrvv-6g7r-g3v8
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/frappe/lms/security/advisories/GHSA-qrvv-6g7r-g3v8		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Nov 12, 2025

Updated Nov 13, 2025

Reserved Nov 10, 2025

Link CVE-2025-64705

CISA Vulnrichment

Updated Nov 13, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-64705

Severity n/a

Public date n/a

Links CVE-2025-64705