Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
408 vulnerabilities by frappe
CVE-2026-94113 (GCVE-0-2026-94113)
Vulnerability from nvd – Published: 2026-09-20 11:56 – Updated: 2026-09-21 16:44
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
Summary
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://github.com/frappe/erpnext/commit/c656497a… | patch |
| https://github.com/frappe/erpnext/commit/d5df4098… | patch |
| https://github.com/frappe/erpnext/pull/58576 | patchissue-tracking |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94113",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:40:38.101380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:44:12.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/erpnext",
"product": "ERPNext",
"repo": "https://github.com/frappe/erpnext",
"vendor": "Frappe",
"versions": [
{
"lessThan": "15.121.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.34.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.121.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.34.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shohruh Yo\u0027ldoshov"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:56:08.372Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9vph-hqmm-g7hq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-9vph-hqmm-g7hq"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/commit/c656497aac76af82eea028e3e8cb8d5380385f0f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/commit/d5df40986d72a55d414ddaf4d382883f9df31e41"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/frappe/erpnext/pull/58576"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-and-16.34.0-missing-authorization-in-timesheet-endpoints"
}
],
"title": "Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94113",
"datePublished": "2026-09-20T11:56:08.372Z",
"dateReserved": "2026-09-20T11:41:41.230Z",
"dateUpdated": "2026-09-21T16:44:12.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54343 (GCVE-0-2026-54343)
Vulnerability from nvd – Published: 2026-09-17 21:35 – Updated: 2026-09-18 20:14
VLAI
EPSS
VEX
Title
Frappe LMS: Path Traversal in SCORM File Serving
Summary
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/lms/security/advisories… | x_refsource_CONFIRM |
| https://github.com/frappe/lms/pull/2299 | x_refsource_MISC |
| https://github.com/frappe/lms/commit/e1b425ed5bf0… | x_refsource_MISC |
| https://github.com/frappe/lms/releases/tag/v2.52.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:14:37.166957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:14:49.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "lms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.52.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:35:53.629Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j"
},
{
"name": "https://github.com/frappe/lms/pull/2299",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/pull/2299"
},
{
"name": "https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465"
},
{
"name": "https://github.com/frappe/lms/releases/tag/v2.52.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/releases/tag/v2.52.1"
}
],
"source": {
"advisory": "GHSA-3mq2-3c8v-m92j",
"discovery": "UNKNOWN"
},
"title": "Frappe LMS: Path Traversal in SCORM File Serving"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54343",
"datePublished": "2026-09-17T21:35:53.629Z",
"dateReserved": "2026-06-12T19:23:22.317Z",
"dateUpdated": "2026-09-18T20:14:49.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54524 (GCVE-0-2026-54524)
Vulnerability from nvd – Published: 2026-09-17 18:33 – Updated: 2026-09-17 19:00
VLAI
EPSS
VEX
Title
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/pull/4515 | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/b1614853195… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:00:29.502131Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:00:53.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:33:37.558Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737"
},
{
"name": "https://github.com/frappe/hrms/pull/4515",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/pull/4515"
},
{
"name": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.7.0"
}
],
"source": {
"advisory": "GHSA-2gv7-x4h2-3737",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54524",
"datePublished": "2026-09-17T18:33:37.558Z",
"dateReserved": "2026-06-15T18:40:01.651Z",
"dateUpdated": "2026-09-17T19:00:53.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-51769 (GCVE-0-2023-51769)
Vulnerability from nvd – Published: 2026-09-14 00:00 – Updated: 2026-09-16 14:35
VLAI
EPSS
VEX
Summary
Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-51769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:34:56.859935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:35:09.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Frappe",
"vendor": "Frappe",
"versions": [
{
"lessThan": "14.49.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "14.49.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T06:21:03.144Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-439c-3956-r8q7"
},
{
"url": "https://github.com/frappe/frappe/compare/v14.48.1...v14.49.0"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-51769",
"datePublished": "2026-09-14T00:00:00.000Z",
"dateReserved": "2023-12-25T00:00:00.000Z",
"dateUpdated": "2026-09-16T14:35:09.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53761 (GCVE-0-2026-53761)
Vulnerability from nvd – Published: 2026-09-04 18:00 – Updated: 2026-09-04 18:51
VLAI
EPSS
VEX
Title
Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
Summary
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 18:51 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | x_refsource_CONFIRM |
| https://github.com/frappe/crm/releases/tag/v1.73.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T18:51:30.162511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:51:47.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "crm",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 1.73.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:00:42.778Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/crm/security/advisories/GHSA-wqrv-q8m5-qr77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-wqrv-q8m5-qr77"
},
{
"name": "https://github.com/frappe/crm/releases/tag/v1.73.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.73.0"
}
],
"source": {
"advisory": "GHSA-wqrv-q8m5-qr77",
"discovery": "UNKNOWN"
},
"title": "Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53761",
"datePublished": "2026-09-04T18:00:42.778Z",
"dateReserved": "2026-06-10T17:48:40.546Z",
"dateUpdated": "2026-09-04T18:51:47.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82634 (GCVE-0-2026-82634)
Vulnerability from nvd – Published: 2026-08-30 12:34 – Updated: 2026-08-31 16:53
VLAI
EPSS
VEX
Title
Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Summary
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:53 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/pull/40710 | issue-trackingpatch |
| https://github.com/frappe/frappe/commit/37d2eb597… | patch |
| https://github.com/frappe/frappe/blob/0a80046da32… | technical-description |
| https://github.com/frappe/frappe | product |
| https://www.vulncheck.com/advisories/frappe-frame… | third-party-advisory |
Impacted products
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:53:15.895383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:53:42.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "37d2eb59790633da01c741b950cc00ca3558c494",
"status": "affected",
"version": "0a80046da32bb8976cd7854f551c179a4a06b1b3",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Holmquist (Hasp Labs)"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T12:34:52.482Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #40710",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/frappe/frappe/pull/40710"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frappe/frappe/commit/37d2eb59790633da01c741b950cc00ca3558c494"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/0a80046da32bb8976cd7854f551c179a4a06b1b3/frappe/utils/print_format_generator.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/frappe"
},
{
"name": "VulnCheck Advisory: Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-framework-development-branch-incorrect-authorization-via-jinja-template-preview-endpoint"
}
],
"title": "Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82634",
"datePublished": "2026-08-30T12:34:52.482Z",
"dateReserved": "2026-08-30T11:59:07.493Z",
"dateUpdated": "2026-08-31T16:53:42.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81731 (GCVE-0-2026-81731)
Vulnerability from nvd – Published: 2026-08-27 20:07 – Updated: 2026-08-31 18:56
VLAI
EPSS
VEX
Title
Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
Summary
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace's card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/commit/9f65e5cec… | patch |
| https://github.com/frappe/frappe | product |
| https://github.com/frappe/frappe/blob/v16.32.0/fr… | technical-description |
| https://github.com/frappe/frappe/blob/v16.32.0/fr… | technical-description |
| https://www.vulncheck.com/advisories/frappe-15.11… | third-party-advisory |
Impacted products
Date Public
2026-07-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:39.534697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:56:00.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThanOrEqual": "16.32.0",
"status": "affected",
"version": "15.11.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndIncluding": "16.32.0",
"versionStartIncluding": "15.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Holmquist (HASP Labs)"
}
],
"datePublic": "2026-07-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with \"ignore_xss_filter\": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace\u0027s card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:07:35.561Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frappe/frappe/commit/9f65e5ceca71aae91dcfd9bb3c0904afd386a01a"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/frappe"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/v16.32.0/frappe/desk/doctype/workspace_link/workspace_link.json#L118"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/v16.32.0/frappe/public/js/frappe/widgets/links_widget.js#L37"
},
{
"name": "VulnCheck Advisory: Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-15.11.0-through-16.32.0-stored-xss-via-workspace-link-description"
}
],
"title": "Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-81731",
"datePublished": "2026-08-27T20:07:35.561Z",
"dateReserved": "2026-08-27T11:15:29.421Z",
"dateUpdated": "2026-08-31T18:56:00.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66003 (GCVE-0-2026-66003)
Vulnerability from nvd – Published: 2026-08-26 19:30 – Updated: 2026-08-27 14:44
VLAI
EPSS
VEX
Title
Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Summary
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:43 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/releases/tag/v15.115.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:43:45.285833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:44:42.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.115.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType\u0027s own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:30:28.968Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-p25m-7rvg-6fvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-p25m-7rvg-6fvr"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.115.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.115.0"
}
],
"source": {
"advisory": "GHSA-p25m-7rvg-6fvr",
"discovery": "UNKNOWN"
},
"title": "Frappe: Access control bypass via REST API dot-notation fields on linked doctypes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66003",
"datePublished": "2026-08-26T19:30:28.968Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-27T14:44:42.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66002 (GCVE-0-2026-66002)
Vulnerability from nvd – Published: 2026-08-20 18:29 – Updated: 2026-08-21 21:46
VLAI
EPSS
VEX
Title
Frappe: User Enumeration via PDDR
Summary
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:09 UTC
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40787 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40814 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40815 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/30fe0b411… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/47a396ec5… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/4b32a4e00… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.115.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.27.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:09:35.845729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:46:12.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.115.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:29:40.872Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-c2xv-c53h-qvr5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-c2xv-c53h-qvr5"
},
{
"name": "https://github.com/frappe/frappe/pull/40787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40787"
},
{
"name": "https://github.com/frappe/frappe/pull/40814",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40814"
},
{
"name": "https://github.com/frappe/frappe/pull/40815",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40815"
},
{
"name": "https://github.com/frappe/frappe/commit/30fe0b4118ff94c95c239dce4bc74ec4ca10a827",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/30fe0b4118ff94c95c239dce4bc74ec4ca10a827"
},
{
"name": "https://github.com/frappe/frappe/commit/47a396ec59f5362029feb349eb2b9d10a21afcf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/47a396ec59f5362029feb349eb2b9d10a21afcf8"
},
{
"name": "https://github.com/frappe/frappe/commit/4b32a4e0072e61ce0abcb0d09cfd1f14724fe896",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/4b32a4e0072e61ce0abcb0d09cfd1f14724fe896"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.115.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.115.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.27.0"
}
],
"source": {
"advisory": "GHSA-c2xv-c53h-qvr5",
"discovery": "UNKNOWN"
},
"title": "Frappe: User Enumeration via PDDR"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66002",
"datePublished": "2026-08-20T18:29:40.872Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-21T21:46:12.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66001 (GCVE-0-2026-66001)
Vulnerability from nvd – Published: 2026-08-20 18:27 – Updated: 2026-08-25 15:20
VLAI
EPSS
VEX
Title
Frappe: Improper Authorization in OAuth2 Consent Endpoint
Summary
Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:20 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40073 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40700 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40701 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/336c7d335… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d7460769f… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/eb9c1446c… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.114.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.26.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:20:04.226255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:20:17.550Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.114.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:27:32.056Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-2ph8-x773-8p2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-2ph8-x773-8p2x"
},
{
"name": "https://github.com/frappe/frappe/pull/40073",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40073"
},
{
"name": "https://github.com/frappe/frappe/pull/40700",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40700"
},
{
"name": "https://github.com/frappe/frappe/pull/40701",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40701"
},
{
"name": "https://github.com/frappe/frappe/commit/336c7d335db762b494acdfe43aea69d459fd51d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/336c7d335db762b494acdfe43aea69d459fd51d7"
},
{
"name": "https://github.com/frappe/frappe/commit/d7460769f999c68d3121b680119f8724ddd3eb9d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d7460769f999c68d3121b680119f8724ddd3eb9d"
},
{
"name": "https://github.com/frappe/frappe/commit/eb9c1446cac13236c6d573b136786db2e46254fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/eb9c1446cac13236c6d573b136786db2e46254fa"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.114.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.114.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.26.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.26.0"
}
],
"source": {
"advisory": "GHSA-2ph8-x773-8p2x",
"discovery": "UNKNOWN"
},
"title": "Frappe: Improper Authorization in OAuth2 Consent Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66001",
"datePublished": "2026-08-20T18:27:32.056Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-25T15:20:17.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63654 (GCVE-0-2026-63654)
Vulnerability from nvd – Published: 2026-08-20 18:23 – Updated: 2026-08-20 19:47
VLAI
EPSS
VEX
Title
Frappe: Unauthenticated Workflow approval via confirm_action
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:47 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/41361 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/8465376ad… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:47:26.907767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:47:38.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:23:52.994Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm"
},
{
"name": "https://github.com/frappe/frappe/pull/41361",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/41361"
},
{
"name": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f"
}
],
"source": {
"advisory": "GHSA-cgwf-xgph-hxgm",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unauthenticated Workflow approval via confirm_action"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63654",
"datePublished": "2026-08-20T18:23:52.994Z",
"dateReserved": "2026-07-17T14:47:08.031Z",
"dateUpdated": "2026-08-20T19:47:38.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62315 (GCVE-0-2026-62315)
Vulnerability from nvd – Published: 2026-08-20 18:25 – Updated: 2026-08-20 18:56
VLAI
EPSS
VEX
Title
Frappe: Mass assignment via set_value
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:53 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/38951 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/2a04fae93… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:53:53.424208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:56:44.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:25:01.277Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-2c6h-wv85-fxvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-2c6h-wv85-fxvj"
},
{
"name": "https://github.com/frappe/frappe/pull/38951",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/38951"
},
{
"name": "https://github.com/frappe/frappe/commit/2a04fae9353c02f0a9ce9f40f92c1eba6765c77b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/2a04fae9353c02f0a9ce9f40f92c1eba6765c77b"
}
],
"source": {
"advisory": "GHSA-2c6h-wv85-fxvj",
"discovery": "UNKNOWN"
},
"title": "Frappe: Mass assignment via set_value"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62315",
"datePublished": "2026-08-20T18:25:01.277Z",
"dateReserved": "2026-07-13T19:27:58.314Z",
"dateUpdated": "2026-08-20T18:56:44.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53569 (GCVE-0-2026-53569)
Vulnerability from nvd – Published: 2026-08-20 18:15 – Updated: 2026-08-20 19:03
VLAI
EPSS
VEX
Title
Frappe: Missing authorization in toggle_like and mark_as_seen
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/39760 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/91155d12d… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/aeb93abe6… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:03:00.153778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:03:07.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:15:20.170Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x"
},
{
"name": "https://github.com/frappe/frappe/pull/39760",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/39760"
},
{
"name": "https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1"
},
{
"name": "https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e"
}
],
"source": {
"advisory": "GHSA-rx6h-4p83-m76x",
"discovery": "UNKNOWN"
},
"title": "Frappe: Missing authorization in toggle_like and mark_as_seen"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53569",
"datePublished": "2026-08-20T18:15:20.170Z",
"dateReserved": "2026-06-09T19:11:53.483Z",
"dateUpdated": "2026-08-20T19:03:07.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65974 (GCVE-0-2026-65974)
Vulnerability from nvd – Published: 2026-08-17 20:44 – Updated: 2026-08-18 14:17
VLAI
EPSS
VEX
Title
ERPNext: Server-Side Template Injection leading to Remote Code Execution
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:16 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/529d190a2… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:16:59.926975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:17:47.852Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:44:20.818Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr"
},
{
"name": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-w996-r7v3-87wr",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Server-Side Template Injection leading to Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65974",
"datePublished": "2026-08-17T20:44:20.818Z",
"dateReserved": "2026-07-23T18:15:14.580Z",
"dateUpdated": "2026-08-18T14:17:47.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65822 (GCVE-0-2026-65822)
Vulnerability from nvd – Published: 2026-08-17 20:45 – Updated: 2026-08-18 13:01
VLAI
EPSS
VEX
Title
ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 12:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55721 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/29dd6e66… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/f43af662… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.23.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T12:57:40.825451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:01:42.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.116.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:45:45.647Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959"
},
{
"name": "https://github.com/frappe/erpnext/pull/55721",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55721"
},
{
"name": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e"
},
{
"name": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.116.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.116.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-x35x-4mvx-h959",
"discovery": "UNKNOWN"
},
"title": "ERPNext: SQL Injection in \"Inactive Customers\" report via unvalidated `doctype` filter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65822",
"datePublished": "2026-08-17T20:45:45.647Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-08-18T13:01:42.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94113 (GCVE-0-2026-94113)
Vulnerability from cvelistv5 – Published: 2026-09-20 11:56 – Updated: 2026-09-21 16:44
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
Summary
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://github.com/frappe/erpnext/commit/c656497a… | patch |
| https://github.com/frappe/erpnext/commit/d5df4098… | patch |
| https://github.com/frappe/erpnext/pull/58576 | patchissue-tracking |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94113",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:40:38.101380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:44:12.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/erpnext",
"product": "ERPNext",
"repo": "https://github.com/frappe/erpnext",
"vendor": "Frappe",
"versions": [
{
"lessThan": "15.121.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.34.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.121.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.34.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shohruh Yo\u0027ldoshov"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:56:08.372Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9vph-hqmm-g7hq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-9vph-hqmm-g7hq"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/commit/c656497aac76af82eea028e3e8cb8d5380385f0f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/commit/d5df40986d72a55d414ddaf4d382883f9df31e41"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/frappe/erpnext/pull/58576"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-and-16.34.0-missing-authorization-in-timesheet-endpoints"
}
],
"title": "Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94113",
"datePublished": "2026-09-20T11:56:08.372Z",
"dateReserved": "2026-09-20T11:41:41.230Z",
"dateUpdated": "2026-09-21T16:44:12.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54343 (GCVE-0-2026-54343)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:35 – Updated: 2026-09-18 20:14
VLAI
EPSS
VEX
Title
Frappe LMS: Path Traversal in SCORM File Serving
Summary
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:14 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/lms/security/advisories… | x_refsource_CONFIRM |
| https://github.com/frappe/lms/pull/2299 | x_refsource_MISC |
| https://github.com/frappe/lms/commit/e1b425ed5bf0… | x_refsource_MISC |
| https://github.com/frappe/lms/releases/tag/v2.52.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:14:37.166957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:14:49.268Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "lms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 2.52.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_renderers.py. The renderer constructs and opens a server-side path without first confirming that its real path remains within public/scorm, allowing files outside the SCORM directory to be read when they are accessible to the server process. This issue is fixed in version 2.52.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:35:53.629Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/lms/security/advisories/GHSA-3mq2-3c8v-m92j"
},
{
"name": "https://github.com/frappe/lms/pull/2299",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/pull/2299"
},
{
"name": "https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/commit/e1b425ed5bf0fc9c373efc1ba235c7c70e23d465"
},
{
"name": "https://github.com/frappe/lms/releases/tag/v2.52.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/lms/releases/tag/v2.52.1"
}
],
"source": {
"advisory": "GHSA-3mq2-3c8v-m92j",
"discovery": "UNKNOWN"
},
"title": "Frappe LMS: Path Traversal in SCORM File Serving"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54343",
"datePublished": "2026-09-17T21:35:53.629Z",
"dateReserved": "2026-06-12T19:23:22.317Z",
"dateUpdated": "2026-09-18T20:14:49.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54524 (GCVE-0-2026-54524)
Vulnerability from cvelistv5 – Published: 2026-09-17 18:33 – Updated: 2026-09-17 19:00
VLAI
EPSS
VEX
Title
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/pull/4515 | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/b1614853195… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.7.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:00:29.502131Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:00:53.087Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:33:37.558Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737"
},
{
"name": "https://github.com/frappe/hrms/pull/4515",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/pull/4515"
},
{
"name": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.7.0"
}
],
"source": {
"advisory": "GHSA-2gv7-x4h2-3737",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54524",
"datePublished": "2026-09-17T18:33:37.558Z",
"dateReserved": "2026-06-15T18:40:01.651Z",
"dateUpdated": "2026-09-17T19:00:53.087Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-51769 (GCVE-0-2023-51769)
Vulnerability from cvelistv5 – Published: 2026-09-14 00:00 – Updated: 2026-09-16 14:35
VLAI
EPSS
VEX
Summary
Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-51769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:34:56.859935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:35:09.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Frappe",
"vendor": "Frappe",
"versions": [
{
"lessThan": "14.49.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "14.49.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T06:21:03.144Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-439c-3956-r8q7"
},
{
"url": "https://github.com/frappe/frappe/compare/v14.48.1...v14.49.0"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-51769",
"datePublished": "2026-09-14T00:00:00.000Z",
"dateReserved": "2023-12-25T00:00:00.000Z",
"dateUpdated": "2026-09-16T14:35:09.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53761 (GCVE-0-2026-53761)
Vulnerability from cvelistv5 – Published: 2026-09-04 18:00 – Updated: 2026-09-04 18:51
VLAI
EPSS
VEX
Title
Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
Summary
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 18:51 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | x_refsource_CONFIRM |
| https://github.com/frappe/crm/releases/tag/v1.73.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53761",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T18:51:30.162511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:51:47.196Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "crm",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 1.73.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there is an authentication bypass vulnerability via logged invitation keys in crm/api. This issue has been patched in version 1.73.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:00:42.778Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/crm/security/advisories/GHSA-wqrv-q8m5-qr77",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-wqrv-q8m5-qr77"
},
{
"name": "https://github.com/frappe/crm/releases/tag/v1.73.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.73.0"
}
],
"source": {
"advisory": "GHSA-wqrv-q8m5-qr77",
"discovery": "UNKNOWN"
},
"title": "Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53761",
"datePublished": "2026-09-04T18:00:42.778Z",
"dateReserved": "2026-06-10T17:48:40.546Z",
"dateUpdated": "2026-09-04T18:51:47.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82634 (GCVE-0-2026-82634)
Vulnerability from cvelistv5 – Published: 2026-08-30 12:34 – Updated: 2026-08-31 16:53
VLAI
EPSS
VEX
Title
Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint
Summary
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:53 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/pull/40710 | issue-trackingpatch |
| https://github.com/frappe/frappe/commit/37d2eb597… | patch |
| https://github.com/frappe/frappe/blob/0a80046da32… | technical-description |
| https://github.com/frappe/frappe | product |
| https://www.vulncheck.com/advisories/frappe-frame… | third-party-advisory |
Impacted products
Date Public
2026-07-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:53:15.895383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:53:42.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "37d2eb59790633da01c741b950cc00ca3558c494",
"status": "affected",
"version": "0a80046da32bb8976cd7854f551c179a4a06b1b3",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Holmquist (Hasp Labs)"
}
],
"datePublic": "2026-07-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-30T12:34:52.482Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #40710",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/frappe/frappe/pull/40710"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frappe/frappe/commit/37d2eb59790633da01c741b950cc00ca3558c494"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/0a80046da32bb8976cd7854f551c179a4a06b1b3/frappe/utils/print_format_generator.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/frappe"
},
{
"name": "VulnCheck Advisory: Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-framework-development-branch-incorrect-authorization-via-jinja-template-preview-endpoint"
}
],
"title": "Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82634",
"datePublished": "2026-08-30T12:34:52.482Z",
"dateReserved": "2026-08-30T11:59:07.493Z",
"dateUpdated": "2026-08-31T16:53:42.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81731 (GCVE-0-2026-81731)
Vulnerability from cvelistv5 – Published: 2026-08-27 20:07 – Updated: 2026-08-31 18:56
VLAI
EPSS
VEX
Title
Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
Summary
Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore_xss_filter": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace's card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/commit/9f65e5cec… | patch |
| https://github.com/frappe/frappe | product |
| https://github.com/frappe/frappe/blob/v16.32.0/fr… | technical-description |
| https://github.com/frappe/frappe/blob/v16.32.0/fr… | technical-description |
| https://www.vulncheck.com/advisories/frappe-15.11… | third-party-advisory |
Impacted products
Date Public
2026-07-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:39.534697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:56:00.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThanOrEqual": "16.32.0",
"status": "affected",
"version": "15.11.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndIncluding": "16.32.0",
"versionStartIncluding": "15.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Holmquist (HASP Labs)"
}
],
"datePublic": "2026-07-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with \"ignore_xss_filter\": 1 in frappe/desk/doctype/workspace_link/workspace_link.json, and _sanitize_content() in frappe/model/base_document.py skips any field carrying that flag, so the value is stored exactly as submitted. frappe.desk.desktop.get_desktop_page returns it unchanged, and LinksWidget.set_body() in frappe/public/js/frappe/widgets/links_widget.js interpolates it into a Bootstrap popover created with html: true, by way of the __() translation helper, which performs no HTML escaping. A user holding the Workspace Manager role can therefore place arbitrary markup in a public workspace\u0027s card description and have it execute in the session of any desk user who opens that workspace and hovers the description, including higher-privileged users, allowing session token theft and authenticated requests as the victim. The flag is removed on the development branch but remains present in the shipped 15.x and 16.x release lines, so no released version carries the fix."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:07:35.561Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/frappe/frappe/commit/9f65e5ceca71aae91dcfd9bb3c0904afd386a01a"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/frappe"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/v16.32.0/frappe/desk/doctype/workspace_link/workspace_link.json#L118"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/frappe/blob/v16.32.0/frappe/public/js/frappe/widgets/links_widget.js#L37"
},
{
"name": "VulnCheck Advisory: Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-15.11.0-through-16.32.0-stored-xss-via-workspace-link-description"
}
],
"title": "Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-81731",
"datePublished": "2026-08-27T20:07:35.561Z",
"dateReserved": "2026-08-27T11:15:29.421Z",
"dateUpdated": "2026-08-31T18:56:00.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66003 (GCVE-0-2026-66003)
Vulnerability from cvelistv5 – Published: 2026-08-26 19:30 – Updated: 2026-08-27 14:44
VLAI
EPSS
VEX
Title
Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Summary
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:43 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/releases/tag/v15.115.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:43:45.285833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:44:42.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.115.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType\u0027s own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:30:28.968Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-p25m-7rvg-6fvr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-p25m-7rvg-6fvr"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.115.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.115.0"
}
],
"source": {
"advisory": "GHSA-p25m-7rvg-6fvr",
"discovery": "UNKNOWN"
},
"title": "Frappe: Access control bypass via REST API dot-notation fields on linked doctypes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66003",
"datePublished": "2026-08-26T19:30:28.968Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-27T14:44:42.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66002 (GCVE-0-2026-66002)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:29 – Updated: 2026-08-21 21:46
VLAI
EPSS
VEX
Title
Frappe: User Enumeration via PDDR
Summary
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:09 UTC
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40787 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40814 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40815 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/30fe0b411… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/47a396ec5… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/4b32a4e00… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.115.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.27.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:09:35.845729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:46:12.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.115.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:29:40.872Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-c2xv-c53h-qvr5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-c2xv-c53h-qvr5"
},
{
"name": "https://github.com/frappe/frappe/pull/40787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40787"
},
{
"name": "https://github.com/frappe/frappe/pull/40814",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40814"
},
{
"name": "https://github.com/frappe/frappe/pull/40815",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40815"
},
{
"name": "https://github.com/frappe/frappe/commit/30fe0b4118ff94c95c239dce4bc74ec4ca10a827",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/30fe0b4118ff94c95c239dce4bc74ec4ca10a827"
},
{
"name": "https://github.com/frappe/frappe/commit/47a396ec59f5362029feb349eb2b9d10a21afcf8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/47a396ec59f5362029feb349eb2b9d10a21afcf8"
},
{
"name": "https://github.com/frappe/frappe/commit/4b32a4e0072e61ce0abcb0d09cfd1f14724fe896",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/4b32a4e0072e61ce0abcb0d09cfd1f14724fe896"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.115.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.115.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.27.0"
}
],
"source": {
"advisory": "GHSA-c2xv-c53h-qvr5",
"discovery": "UNKNOWN"
},
"title": "Frappe: User Enumeration via PDDR"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66002",
"datePublished": "2026-08-20T18:29:40.872Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-21T21:46:12.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66001 (GCVE-0-2026-66001)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:27 – Updated: 2026-08-25 15:20
VLAI
EPSS
VEX
Title
Frappe: Improper Authorization in OAuth2 Consent Endpoint
Summary
Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:20 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40073 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40700 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40701 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/336c7d335… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d7460769f… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/eb9c1446c… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.114.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.26.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:20:04.226255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:20:17.550Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.114.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.26.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:27:32.056Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-2ph8-x773-8p2x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-2ph8-x773-8p2x"
},
{
"name": "https://github.com/frappe/frappe/pull/40073",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40073"
},
{
"name": "https://github.com/frappe/frappe/pull/40700",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40700"
},
{
"name": "https://github.com/frappe/frappe/pull/40701",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40701"
},
{
"name": "https://github.com/frappe/frappe/commit/336c7d335db762b494acdfe43aea69d459fd51d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/336c7d335db762b494acdfe43aea69d459fd51d7"
},
{
"name": "https://github.com/frappe/frappe/commit/d7460769f999c68d3121b680119f8724ddd3eb9d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d7460769f999c68d3121b680119f8724ddd3eb9d"
},
{
"name": "https://github.com/frappe/frappe/commit/eb9c1446cac13236c6d573b136786db2e46254fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/eb9c1446cac13236c6d573b136786db2e46254fa"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.114.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.114.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.26.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.26.0"
}
],
"source": {
"advisory": "GHSA-2ph8-x773-8p2x",
"discovery": "UNKNOWN"
},
"title": "Frappe: Improper Authorization in OAuth2 Consent Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66001",
"datePublished": "2026-08-20T18:27:32.056Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-25T15:20:17.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62315 (GCVE-0-2026-62315)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:25 – Updated: 2026-08-20 18:56
VLAI
EPSS
VEX
Title
Frappe: Mass assignment via set_value
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 18:53 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/38951 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/2a04fae93… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T18:53:53.424208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:56:44.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:25:01.277Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-2c6h-wv85-fxvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-2c6h-wv85-fxvj"
},
{
"name": "https://github.com/frappe/frappe/pull/38951",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/38951"
},
{
"name": "https://github.com/frappe/frappe/commit/2a04fae9353c02f0a9ce9f40f92c1eba6765c77b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/2a04fae9353c02f0a9ce9f40f92c1eba6765c77b"
}
],
"source": {
"advisory": "GHSA-2c6h-wv85-fxvj",
"discovery": "UNKNOWN"
},
"title": "Frappe: Mass assignment via set_value"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62315",
"datePublished": "2026-08-20T18:25:01.277Z",
"dateReserved": "2026-07-13T19:27:58.314Z",
"dateUpdated": "2026-08-20T18:56:44.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63654 (GCVE-0-2026-63654)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:23 – Updated: 2026-08-20 19:47
VLAI
EPSS
VEX
Title
Frappe: Unauthenticated Workflow approval via confirm_action
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:47 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/41361 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/8465376ad… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:47:26.907767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:47:38.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:23:52.994Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm"
},
{
"name": "https://github.com/frappe/frappe/pull/41361",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/41361"
},
{
"name": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f"
}
],
"source": {
"advisory": "GHSA-cgwf-xgph-hxgm",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unauthenticated Workflow approval via confirm_action"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63654",
"datePublished": "2026-08-20T18:23:52.994Z",
"dateReserved": "2026-07-17T14:47:08.031Z",
"dateUpdated": "2026-08-20T19:47:38.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53569 (GCVE-0-2026-53569)
Vulnerability from cvelistv5 – Published: 2026-08-20 18:15 – Updated: 2026-08-20 19:03
VLAI
EPSS
VEX
Title
Frappe: Missing authorization in toggle_like and mark_as_seen
Summary
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/39760 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/91155d12d… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/aeb93abe6… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:03:00.153778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:03:07.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c= 16.31.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata. No released fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:15:20.170Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x"
},
{
"name": "https://github.com/frappe/frappe/pull/39760",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/39760"
},
{
"name": "https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1"
},
{
"name": "https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e"
}
],
"source": {
"advisory": "GHSA-rx6h-4p83-m76x",
"discovery": "UNKNOWN"
},
"title": "Frappe: Missing authorization in toggle_like and mark_as_seen"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53569",
"datePublished": "2026-08-20T18:15:20.170Z",
"dateReserved": "2026-06-09T19:11:53.483Z",
"dateUpdated": "2026-08-20T19:03:07.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65822 (GCVE-0-2026-65822)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:45 – Updated: 2026-08-18 13:01
VLAI
EPSS
VEX
Title
ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 12:57 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55721 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/29dd6e66… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/f43af662… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.23.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65822",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T12:57:40.825451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:01:42.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.116.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:45:45.647Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-x35x-4mvx-h959"
},
{
"name": "https://github.com/frappe/erpnext/pull/55721",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55721"
},
{
"name": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/29dd6e6681d20bbacb69517d2d2c875aa929eb9e"
},
{
"name": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/f43af6624610e874e61ad3faf8701e5e6be6271a"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.116.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.116.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-x35x-4mvx-h959",
"discovery": "UNKNOWN"
},
"title": "ERPNext: SQL Injection in \"Inactive Customers\" report via unvalidated `doctype` filter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65822",
"datePublished": "2026-08-17T20:45:45.647Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-08-18T13:01:42.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65974 (GCVE-0-2026-65974)
Vulnerability from cvelistv5 – Published: 2026-08-17 20:44 – Updated: 2026-08-18 14:17
VLAI
EPSS
VEX
Title
ERPNext: Server-Side Template Injection leading to Remote Code Execution
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:16 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/529d190a2… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:16:59.926975Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:17:47.852Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T20:44:20.818Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-w996-r7v3-87wr"
},
{
"name": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/529d190a252863672164d10bfcd91d1de0ac1c7c"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-w996-r7v3-87wr",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Server-Side Template Injection leading to Remote Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65974",
"datePublished": "2026-08-17T20:44:20.818Z",
"dateReserved": "2026-07-23T18:15:14.580Z",
"dateUpdated": "2026-08-18T14:17:47.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}