In Frappe Learning Management System versions 2.44.0 and earlier, a flaw in the API allows users without proper authorization to retrieve detailed information about courses that are still unpublished. This results in an information‑disclosure vulnerability that could reveal sensitive course outlines, metadata, or other preliminary content. The weakness stems from insufficient access control (CWE‑284) and the lack of proper privilege checks (CWE‑862).

Affected are installations of Frappe LMS at or below version 2.44.0. The issue is tied to the core API endpoints that expose course details. Users who do not meet the required role or permission threshold can trigger the leak. No other product versions are listed as affected in the advisory.

The severity score of 6.9 is moderate, and the EPSS score indicates a very low probability of exploitation (<1%). The vulnerability is not currently listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending crafted HTTP requests to the publicly reachable API endpoints; no additional privileges or exploits are required beyond unauthenticated access. Because the vulnerability is tied to API calls, the likely vector is the network layer, and an attacker only needs to observe or guess a known endpoint. The overall risk remains limited but the detail exposure mandates a remedial action.