Auth bypass in Frappe Lms

CVE-2025-64707

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a role from the user, the effect was not immediate because of caching. The issue has…

Vulnerability class: Broken Access Control

EPSS: 0.000 (10.0th percentile) — read the EPSS interpretation.

Affected products

Frappe Lms — versions >= 2.0.0, < 2.41.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

https://github.com/frappe/lms/security/advisories/GHSA-w2gf-rchw-x6vm (x_refsource_CONFIRM)