CVE-2025-66581: Frappe LMS is Missing Server-Side Authorization in Business Logic
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.41.0, a flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Because the affected endpoints relied on client-side or UI-level checks instead of enforcing permissions on the server, users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. This vulnerability is fixed in 2.41.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66581?
CVE-2025-66581 is considered a critical vulnerability due to its impact on server-side authorization logic.
How do I fix CVE-2025-66581?
To fix CVE-2025-66581, upgrade to Frappe Learning Management System version 2.41.0 or later.
What are the consequences of CVE-2025-66581?
CVE-2025-66581 allows authenticated users to perform unauthorized actions, potentially compromising system integrity and user data.
Which software versions are affected by CVE-2025-66581?
CVE-2025-66581 affects all versions of Frappe Learning Management System prior to 2.41.0.
Is CVE-2025-66581 exploitable remotely?
CVE-2025-66581 is not exploitable remotely as it requires authenticated access to the system.