Missing Server-Side Authorization in Business Logic Package: lms (frappe) Severity: Low CVE ID: CVE-2025-66581 Affected versions: 2.0.0 Patched versions: 2.41.0 Impact A flaw in the server-side authorization logic allowed authenticated users to perform actions beyond their assigned roles across multiple features. Users with low-privileged roles (such as students) could perform operations intended only for instructors or administrators via directly using the API's. As a result, students with a valid user account could: 1. Enroll themselves and other users into unpublished course batches 2. Enroll themselves in unpublished batches 3. Delete sidebar pages 4. Post discussion messages in a batch or a course they are not enrolled in 5. Modify course and batch metadata 6. Generate course certificates without meeting completion requirements 7. Send batch-wide announcements to learners 8. Assign badges to themselves and other users Patches The problem has been fixed with the release 2.41.0. Acknowledgement Reported by Devansh