The vulnerability is an authorization failure that allows unauthenticated or unauthorised users to retrieve the complete list of students enrolled in a batch by their email addresses. This exposes private user information and can enable social engineering or privacy violations. The weakness is categorized as CWE‑863.

The affected product is the Frappe Learning Management System (LMS) from the vendor frappe:lms. Versions prior to 2.44.0 are impacted, including all releases 2.43.x and earlier. No other vendors or products were identified.

The CVSS score of 1.3 reflects a low overall impact, but the disclosure of personal emails is a notable privacy concern. The EPSS score is below 1%, indicating a low likelihood of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be unauthenticated or unauthorised access to the LMS application, requiring the attacker to interact with the application’s API or web interface. Since the flaw is an authorization oversight, standard preventive controls such as proper role‑based access checks are required to mitigate exploitation.