frappe Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with frappe.

Products

Clear product

Showing 25 vulnerabilities on this page for frappe

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.

CWE-863Aug 7, 2026
CVSS2.3v4.0EPSS0.259%PoCs0SignalsSTIX

Frappe has potential SQL Injection due to missing validation

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.

CWE-89Aug 7, 2026
CVSS8.1v3.1EPSS0.341%PoCs0SignalsSTIX

Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

CWE-639CWE-862Aug 7, 2026
CVSS5.3v4.0EPSS0.225%PoCs0SignalsSTIX

Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

CWE-863Aug 7, 2026
CVSS5.3v4.0EPSS0.275%PoCs0SignalsSTIX

Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

CWE-79Aug 6, 2026
CVSS5.1v4.0EPSS0.343%PoCs0SignalsSTIX

Frappe: Lack of Permissions in restore/bulk_restore

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.

CWE-862Aug 6, 2026
CVSS7.1v4.0EPSS0.431%PoCs0SignalsSTIX

Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.

CWE-346Aug 6, 2026
CVSS8.6v4.0EPSS0.201%PoCs1SignalsSTIX

Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

CWE-79CWE-863Aug 6, 2026
CVSS5.1v4.0EPSS0.393%PoCs0SignalsSTIX

Frappe: TarSlip RCE in Package Import

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.

CWE-22Jul 10, 2026
CVSS8.6v4.0EPSS0.457%PoCs0SignalsSTIX

Frappe: Path Traversal via /backups Route

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, path traversal via download_backups was possible due to lack of hardening. This issue is fixed in versions 16.19.0 and 15.109.0.

CWE-22Jul 10, 2026
CVSS6.9v4.0EPSS0.457%PoCs0SignalsSTIX

Frappe: Auth. bypass via update_page

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

CWE-862Jul 10, 2026
CVSS7.1v4.0EPSS0.307%PoCs0SignalsSTIX

Frappe: Arbitrary Attachment Injection via add_attachments and upload_file

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

CWE-862Jul 10, 2026
CVSS5.3v4.0EPSS0.369%PoCs0SignalsSTIX

Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator

Frappe is a full-stack web application framework. Prior to 16.18.3, possible path traversal and local file inclusion were possible through secure local resource access in the Chrome PDF Generator. This issue is fixed in version 16.18.3.

CWE-22Jul 10, 2026
CVSS7.1v4.0EPSS0.338%PoCs0SignalsSTIX

Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in versions 16.18.3 and 15.108.0.

CWE-89Jul 10, 2026
CVSS2.3v4.0EPSS0.401%PoCs0SignalsSTIX

Frappe: Unauthenticated User Enumeration via reset_password

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

CWE-203Jul 10, 2026
CVSS6.9v4.0EPSS0.354%PoCs0SignalsSTIX

Frappe: Unrestricted API access to save_report

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

CWE-862Jul 10, 2026
CVSS5.3v4.0EPSS0.278%PoCs0SignalsSTIX

Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value'

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, there is a stored XSS vulnerablity in Frappe Report/List View. This issue has been patched in versions 15.107.2 and 16.17.4.

CWE-79Jun 12, 2026
CVSS6.9v4.0EPSS0.258%PoCs0SignalsSTIX

Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

CWE-862Jun 12, 2026
CVSS6.9v4.0EPSS0.26%PoCs0SignalsSTIX

Frappe: Broken Access Control on Private Files

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.

CWE-284Jun 12, 2026
CVSS5.3v4.0EPSS0.278%PoCs0SignalsSTIX

Frappe: IDOR in update_onboarding_step

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.

CWE-284Jun 12, 2026
CVSS5.3v4.0EPSS0.278%PoCs0SignalsSTIX

Frappe: Missing authorization on reset form tours

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4.

CWE-862Jun 12, 2026
CVSS5.3v4.0EPSS0.278%PoCs0SignalsSTIX

Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.

CWE-200Jun 12, 2026
CVSS6.9v4.0EPSS0.312%PoCs0SignalsSTIX

Frappe: Insecure Direct Object Reference for email accounts

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vulnerability allows authenticated users to access other users' email configuration details. This issue has been patched in versions 15.107.0 and 16.17.0.

CWE-639Jun 12, 2026
CVSS6.9v4.0EPSS0.321%PoCs0SignalsSTIX

Frappe: IDOR in `submit_discussion()`

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

CWE-284CWE-285Jun 12, 2026
CVSS6.9v4.0EPSS0.321%PoCs0SignalsSTIX

Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload

Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerability in the user profile image section allows an attacker to execute malicious scripts in the browsers of other users. This issue has been patched in version 15.106.0.

CWE-79Jun 12, 2026
CVSS6.9v4.0EPSS0.258%PoCs0SignalsSTIX