CVE-2026-29077
HIGHFrappe <15.98.0/14.100.0 - Privilege Escalation
Title source: llmDescription
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.
Scores
CVSS v3
7.1
EPSS
0.0004
EPSS Percentile
13.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Classification
CWE
CWE-284
CWE-602
Status
published
Affected Products (1)
frappe/frappe
< 14.100.0
Timeline
Published
Mar 05, 2026
Tracked Since
Mar 06, 2026