Search
Find a vulnerability
Search criteria
614 vulnerabilities by frappe
CVE-2026-114664 (GCVE-0-2026-114664)
Vulnerability from nvd – Published: 2026-10-22 01:43 – Updated: 2026-10-22 01:43
VLAI
EPSS
VEX
Title
Frappe before 16.33.0 Blind SQL Injection via get_events
Summary
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
Severity
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.33.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.33.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AarDG10"
},
{
"lang": "en",
"type": "reporter",
"value": "saadzitouni"
}
],
"datePublic": "2026-10-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:43:47.670Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p4w2-9mr5-6prj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj"
},
{
"name": "VulnCheck Advisory: Frappe before 16.33.0 Blind SQL Injection via get_events",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events"
}
],
"title": "Frappe before 16.33.0 Blind SQL Injection via get_events",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114664",
"datePublished": "2026-10-22T01:43:47.670Z",
"dateReserved": "2026-10-21T21:59:05.257Z",
"dateUpdated": "2026-10-22T01:43:47.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111939 (GCVE-0-2026-111939)
Vulnerability from nvd – Published: 2026-10-19 13:55 – Updated: 2026-10-19 14:23
VLAI
EPSS
VEX
Title
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Summary
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:22 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/helpdesk/security/advis… | vendor-advisory |
| https://github.com/frappe/helpdesk/commit/1186367… | patch |
| https://github.com/frappe/helpdesk/commit/c778f53… | patch |
| https://github.com/frappe/helpdesk/releases/tag/v1.26.0 | release-notes |
| https://github.com/frappe/helpdesk/blob/v1.25.1/h… | technical-description |
| https://github.com/frappe/helpdesk/blob/v1.25.1/h… | technical-description |
| https://www.vulncheck.com/advisories/frappe-helpd… | third-party-advisory |
Date Public
2026-09-21 12:18
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:22:49.644605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:23:03.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/helpdesk",
"product": "helpdesk",
"repo": "https://github.com/frappe/helpdesk",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.26.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-21T12:18:57.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim\u0027s email to plant phishing tickets in their portal and read their replies via get_ticket_activities."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:12.366Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xf93-jjcj-44vm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/helpdesk/security/advisories/GHSA-xf93-jjcj-44vm"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2"
},
{
"name": "Frappe Helpdesk v1.26.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/helpdesk/releases/tag/v1.26.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py"
},
{
"name": "VulnCheck Advisory: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-helpdesk-before-1.26.0-authorization-bypass-via-raised-by-in-ticket-creation"
}
],
"title": "Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111939",
"datePublished": "2026-10-19T13:55:12.366Z",
"dateReserved": "2026-10-17T12:20:52.373Z",
"dateUpdated": "2026-10-19T14:23:03.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111938 (GCVE-0-2026-111938)
Vulnerability from nvd – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:35
VLAI
EPSS
VEX
Title
Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
Summary
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | vendor-advisory |
| https://github.com/frappe/crm/commit/7872f4d178bd… | patch |
| https://github.com/frappe/crm/commit/e30df9109403… | patch |
| https://github.com/frappe/crm/releases/tag/v1.74.0 | release-notes |
| https://github.com/frappe/crm/blob/v1.73.2/crm/in… | technical-description |
| https://www.vulncheck.com/advisories/frappe-crm-b… | third-party-advisory |
Impacted products
Date Public
2026-09-08 07:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:54.259011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:35:11.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/crm",
"product": "crm",
"repo": "https://github.com/frappe/crm",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.74.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.74.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-08T07:04:28.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users\u0027 call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims\u0027 call logs, leads, and deals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:11.692Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-843p-qp2f-p2v8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-843p-qp2f-p2v8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/7872f4d178bd9338dba2eb4fc4808f4060914be6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/e30df91094033d8583a72e429726ba7bebc1534f"
},
{
"name": "Frappe CRM v1.74.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.74.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.73.2/crm/integrations/api.py"
},
{
"name": "VulnCheck Advisory: Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-crm-before-1.74.0-missing-authorization-via-add-note-to-call-log"
}
],
"title": "Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111938",
"datePublished": "2026-10-19T13:55:11.692Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T16:35:11.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111937 (GCVE-0-2026-111937)
Vulnerability from nvd – Published: 2026-10-19 13:55 – Updated: 2026-10-19 18:11
VLAI
EPSS
VEX
Title
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Summary
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | vendor-advisory |
| https://github.com/frappe/crm/commit/a24d73acefa7… | patch |
| https://github.com/frappe/crm/releases/tag/v1.81.2 | release-notes |
| https://github.com/frappe/crm/blob/v1.81.1/crm/ap… | technical-description |
| https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py | technical-description |
| https://github.com/frappe/crm/blob/v1.81.1/crm/fc… | technical-description |
| https://www.vulncheck.com/advisories/frappe-crm-b… | third-party-advisory |
Impacted products
Date Public
2026-09-08 07:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111937",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:08:36.415435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:11:17.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/crm",
"product": "crm",
"repo": "https://github.com/frappe/crm",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.81.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.81.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-08T07:05:28.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users\u0027 CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others\u0027 notifications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:10.989Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4rjw-6mxx-m345)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614"
},
{
"name": "Frappe CRM v1.81.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.81.2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.json"
},
{
"name": "VulnCheck Advisory: Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-records"
}
],
"title": "Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111937",
"datePublished": "2026-10-19T13:55:10.989Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T18:11:17.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64862 (GCVE-0-2026-64862)
Vulnerability from nvd – Published: 2026-10-16 20:52 – Updated: 2026-10-19 16:40
VLAI
EPSS
VEX
Title
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/commit/6214ec8db13… | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/eefb8f4552d… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v15.58.3 | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.4.3 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:16.000160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:40:58.253Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.58.3"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.4.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:52:53.666Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx"
},
{
"name": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94"
},
{
"name": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v15.58.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v15.58.3"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.4.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.4.3"
}
],
"source": {
"advisory": "GHSA-wfc6-cw72-cvhx",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64862",
"datePublished": "2026-10-16T20:52:53.666Z",
"dateReserved": "2026-07-20T18:31:39.291Z",
"dateUpdated": "2026-10-19T16:40:58.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55796 (GCVE-0-2026-55796)
Vulnerability from nvd – Published: 2026-10-16 20:50 – Updated: 2026-10-21 21:29
VLAI
EPSS
VEX
Title
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 21:28 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/commit/d823d20c494… | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/e9eef454250… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v15.60.3 | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.7.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55796",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T21:28:58.555369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:29:08.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.60.3"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:50:01.927Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr"
},
{
"name": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6"
},
{
"name": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v15.60.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v15.60.3"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.7.1"
}
],
"source": {
"advisory": "GHSA-c32r-q985-64xr",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55796",
"datePublished": "2026-10-16T20:50:01.927Z",
"dateReserved": "2026-06-17T14:40:28.380Z",
"dateUpdated": "2026-10-21T21:29:08.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108374 (GCVE-0-2026-108374)
Vulnerability from nvd – Published: 2026-10-16 20:38 – Updated: 2026-10-19 14:29
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised status modification due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:28 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/commit/547d82da… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/86e94803… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/a20fc4f9… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.34.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:28:27.458789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:29:00.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.121.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.34.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user\u0027s permitted role. This issue is fixed in versions 15.121.0 and 16.34.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:38:32.806Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7"
},
{
"name": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89"
},
{
"name": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03"
},
{
"name": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.121.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.121.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.34.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.34.0"
}
],
"source": {
"advisory": "GHSA-5wpj-6rvp-9ff7",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised status modification due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108374",
"datePublished": "2026-10-16T20:38:32.806Z",
"dateReserved": "2026-10-09T21:36:27.042Z",
"dateUpdated": "2026-10-19T14:29:00.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108373 (GCVE-0-2026-108373)
Vulnerability from nvd – Published: 2026-10-16 20:48 – Updated: 2026-10-19 21:26
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised access to financial data due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/commit/202f5227… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/24f0989a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.27.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:25:49.884889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:26:03.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.118.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user\u0027s document permission match conditions. This allows the user to read financial data beyond the user\u0027s permitted role. This issue is fixed in versions 15.118.0 and 16.27.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:48:46.241Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6"
},
{
"name": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e"
},
{
"name": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.27.0"
}
],
"source": {
"advisory": "GHSA-rgrq-243c-c4g6",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised access to financial data due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108373",
"datePublished": "2026-10-16T20:48:46.241Z",
"dateReserved": "2026-10-09T21:36:27.042Z",
"dateUpdated": "2026-10-19T21:26:03.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111389 (GCVE-0-2026-111389)
Vulnerability from nvd – Published: 2026-10-16 01:17 – Updated: 2026-10-18 12:03
VLAI
EPSS
VEX
Title
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Summary
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:58 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-hrms-… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:58:31.282783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:03:17.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "14.38.2",
"status": "affected",
"version": "14.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "14.38.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.64.0",
"status": "affected",
"version": "15.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.64.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.18.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "utkusen"
},
{
"lang": "en",
"type": "finder",
"value": "asmitahase"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:57.752Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jfmr-9jv9-mrw4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-14.0.0-before-14.38.2-sql-injection-via-missing-validation"
}
],
"title": "Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111389",
"datePublished": "2026-10-16T01:17:57.752Z",
"dateReserved": "2026-10-15T21:55:44.538Z",
"dateUpdated": "2026-10-18T12:03:17.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111388 (GCVE-0-2026-111388)
Vulnerability from nvd – Published: 2026-10-16 01:17 – Updated: 2026-10-16 16:23
VLAI
EPSS
VEX
Title
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Summary
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:23 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:23:21.852545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:23:33.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.33.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.33.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.120.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.120.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.33.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.120.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "krupalvora"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:56.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h9jq-7pgf-hw8q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q"
},
{
"name": "VulnCheck Advisory: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.33.0-restrict-ip-allowlist-bypass-via-api-key-oauth-authentication"
}
],
"title": "Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111388",
"datePublished": "2026-10-16T01:17:56.859Z",
"dateReserved": "2026-10-15T21:55:44.538Z",
"dateUpdated": "2026-10-16T16:23:33.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66057 (GCVE-0-2026-66057)
Vulnerability from nvd – Published: 2026-10-13 16:48 – Updated: 2026-10-14 15:37
VLAI
EPSS
VEX
Title
Frappe: Open Redirect via Unsanitized OAuth State Param.
Summary
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:37 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40962 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/12568e2d5… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/1e0a3b941… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/6ed8acd86… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.116.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.29.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:37:05.549194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:37:34.866Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.116.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.29.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:48:03.798Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-78c5-55xg-jm7m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-78c5-55xg-jm7m"
},
{
"name": "https://github.com/frappe/frappe/pull/40962",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40962"
},
{
"name": "https://github.com/frappe/frappe/commit/12568e2d54c4abba70bc0261387053fa28f90988",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/12568e2d54c4abba70bc0261387053fa28f90988"
},
{
"name": "https://github.com/frappe/frappe/commit/1e0a3b941231d74a71ff1a43eee2e9f63c88712d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/1e0a3b941231d74a71ff1a43eee2e9f63c88712d"
},
{
"name": "https://github.com/frappe/frappe/commit/6ed8acd869199feb3a2598887d471448297edf07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/6ed8acd869199feb3a2598887d471448297edf07"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.116.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.116.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.29.0"
}
],
"source": {
"advisory": "GHSA-78c5-55xg-jm7m",
"discovery": "UNKNOWN"
},
"title": "Frappe: Open Redirect via Unsanitized OAuth State Param."
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66057",
"datePublished": "2026-10-13T16:48:03.798Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-10-14T15:37:34.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55823 (GCVE-0-2026-55823)
Vulnerability from nvd – Published: 2026-10-13 16:49 – Updated: 2026-10-13 17:51
VLAI
EPSS
VEX
Title
Frappe: Possibility of SQL injection in reportview
Summary
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:51 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40022 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40027 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/49dbde746… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/f4f2df926… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.23.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:51:48.752488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:51:54.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:49:28.128Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7"
},
{
"name": "https://github.com/frappe/frappe/pull/40022",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40022"
},
{
"name": "https://github.com/frappe/frappe/pull/40027",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40027"
},
{
"name": "https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b"
},
{
"name": "https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-mf6r-q34j-pjw7",
"discovery": "UNKNOWN"
},
"title": "Frappe: Possibility of SQL injection in reportview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55823",
"datePublished": "2026-10-13T16:49:28.128Z",
"dateReserved": "2026-06-17T16:29:38.864Z",
"dateUpdated": "2026-10-13T17:51:54.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109675 (GCVE-0-2026-109675)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-18 12:23
VLAI
EPSS
VEX
Title
Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Summary
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 12:06 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/suite/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-suite… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T12:06:10.395754Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:23:32.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "suite",
"vendor": "frappe",
"versions": [
{
"lessThan": "2697564a9c46da6acc614743eaf9915fe5238f4f",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "unaffected",
"version": "2697564a9c46da6acc614743eaf9915fe5238f4f",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Darshan060224"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users\u0027 data. Attackers can supply another user\u0027s JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:38.881Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4gv8-m97c-4jmv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/suite/security/advisories/GHSA-4gv8-m97c-4jmv"
},
{
"name": "VulnCheck Advisory: Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-suite-before-commit-2697564-broken-access-control-in-mail-mailbox-and-quota-apis"
}
],
"title": "Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109675",
"datePublished": "2026-10-12T22:22:38.881Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-18T12:23:32.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109674 (GCVE-0-2026-109674)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:42
VLAI
EPSS
VEX
Title
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
Summary
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:42 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-03-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:42:23.684918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:42:34.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.98.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.6.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.98.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.6.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.6.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.98.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-03-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:38.179Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wj7p-g62h-jh38)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-wj7p-g62h-jh38"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-16.6.0-sql-injection-via-missing-input-validation"
}
],
"title": "Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109674",
"datePublished": "2026-10-12T22:22:38.179Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-13T13:42:34.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109673 (GCVE-0-2026-109673)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44
VLAI
EPSS
VEX
Title
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
Summary
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:47 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-04-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:47:58.088696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:44:26.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.103.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.12.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.103.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.12.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.12.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.103.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "odgrso"
},
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
}
],
"datePublic": "2026-04-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users\u0027 browsers, enabling data access, modification, and token theft, especially against privileged users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:37.497Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-r99h-h44m-89m2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-r99h-h44m-89m2"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-16.12.0-stored-xss-via-crafted-record-names"
}
],
"title": "Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109673",
"datePublished": "2026-10-12T22:22:37.497Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-13T16:44:26.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109672 (GCVE-0-2026-109672)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 13:56
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Summary
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 13:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T13:54:57.825135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T13:56:50.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.118.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.27.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.118.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.27.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.118.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.27.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xPugal"
},
{
"lang": "en",
"type": "reporter",
"value": "snoopysecurity"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:36.829Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rgrq-243c-c4g6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data"
}
],
"title": "Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109672",
"datePublished": "2026-10-12T22:22:36.829Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-14T13:56:50.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109671 (GCVE-0-2026-109671)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:35
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
Summary
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:34:27.562780Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:35:57.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.113.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.24.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.113.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.24.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.113.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.24.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:36.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rg9g-c26v-cw27)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rg9g-c26v-cw27"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-stored-xss-via-profile-field-in-portal-pages"
}
],
"title": "Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109671",
"datePublished": "2026-10-12T22:22:36.142Z",
"dateReserved": "2026-10-12T21:08:17.598Z",
"dateUpdated": "2026-10-15T14:35:57.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109670 (GCVE-0-2026-109670)
Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-18 12:23
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
Summary
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 12:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-08-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T12:05:58.595314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:23:32.880Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.110.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.21.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.110.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.21.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.110.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.21.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
},
{
"lang": "en",
"type": "reporter",
"value": "utkusen"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:22:35.500Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m6x2-278g-pv2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-m6x2-278g-pv2g"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-stored-xss-via-item-record-name"
}
],
"title": "Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109670",
"datePublished": "2026-10-12T22:22:35.500Z",
"dateReserved": "2026-10-12T21:07:34.160Z",
"dateUpdated": "2026-10-18T12:23:32.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114664 (GCVE-0-2026-114664)
Vulnerability from cvelistv5 – Published: 2026-10-22 01:43 – Updated: 2026-10-22 01:43
VLAI
EPSS
VEX
Title
Frappe before 16.33.0 Blind SQL Injection via get_events
Summary
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
Severity
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.33.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.33.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AarDG10"
},
{
"lang": "en",
"type": "reporter",
"value": "saadzitouni"
}
],
"datePublic": "2026-10-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:43:47.670Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p4w2-9mr5-6prj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-p4w2-9mr5-6prj"
},
{
"name": "VulnCheck Advisory: Frappe before 16.33.0 Blind SQL Injection via get_events",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.33.0-blind-sql-injection-via-get-events"
}
],
"title": "Frappe before 16.33.0 Blind SQL Injection via get_events",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114664",
"datePublished": "2026-10-22T01:43:47.670Z",
"dateReserved": "2026-10-21T21:59:05.257Z",
"dateUpdated": "2026-10-22T01:43:47.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111939 (GCVE-0-2026-111939)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 14:23
VLAI
EPSS
VEX
Title
Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
Summary
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:22 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/helpdesk/security/advis… | vendor-advisory |
| https://github.com/frappe/helpdesk/commit/1186367… | patch |
| https://github.com/frappe/helpdesk/commit/c778f53… | patch |
| https://github.com/frappe/helpdesk/releases/tag/v1.26.0 | release-notes |
| https://github.com/frappe/helpdesk/blob/v1.25.1/h… | technical-description |
| https://github.com/frappe/helpdesk/blob/v1.25.1/h… | technical-description |
| https://www.vulncheck.com/advisories/frappe-helpd… | third-party-advisory |
Date Public
2026-09-21 12:18
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111939",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:22:49.644605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:23:03.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/helpdesk",
"product": "helpdesk",
"repo": "https://github.com/frappe/helpdesk",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.26.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-21T12:18:57.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim\u0027s email to plant phishing tickets in their portal and read their replies via get_ticket_activities."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:12.366Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xf93-jjcj-44vm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/helpdesk/security/advisories/GHSA-xf93-jjcj-44vm"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/helpdesk/commit/1186367f3616a605440e73e6a08eacbbcb9b92d9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/helpdesk/commit/c778f533b24b1dee0c75b206979a9bc4b1be0de2"
},
{
"name": "Frappe Helpdesk v1.26.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/helpdesk/releases/tag/v1.26.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/api.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/helpdesk/blob/v1.25.1/helpdesk/helpdesk/doctype/hd_ticket/hd_ticket.py"
},
{
"name": "VulnCheck Advisory: Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-helpdesk-before-1.26.0-authorization-bypass-via-raised-by-in-ticket-creation"
}
],
"title": "Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111939",
"datePublished": "2026-10-19T13:55:12.366Z",
"dateReserved": "2026-10-17T12:20:52.373Z",
"dateUpdated": "2026-10-19T14:23:03.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111938 (GCVE-0-2026-111938)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:35
VLAI
EPSS
VEX
Title
Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
Summary
Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | vendor-advisory |
| https://github.com/frappe/crm/commit/7872f4d178bd… | patch |
| https://github.com/frappe/crm/commit/e30df9109403… | patch |
| https://github.com/frappe/crm/releases/tag/v1.74.0 | release-notes |
| https://github.com/frappe/crm/blob/v1.73.2/crm/in… | technical-description |
| https://www.vulncheck.com/advisories/frappe-crm-b… | third-party-advisory |
Impacted products
Date Public
2026-09-08 07:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111938",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:54.259011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:35:11.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/crm",
"product": "crm",
"repo": "https://github.com/frappe/crm",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.74.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.74.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-08T07:04:28.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users\u0027 call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims\u0027 call logs, leads, and deals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:11.692Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-843p-qp2f-p2v8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-843p-qp2f-p2v8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/7872f4d178bd9338dba2eb4fc4808f4060914be6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/e30df91094033d8583a72e429726ba7bebc1534f"
},
{
"name": "Frappe CRM v1.74.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.74.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.73.2/crm/integrations/api.py"
},
{
"name": "VulnCheck Advisory: Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-crm-before-1.74.0-missing-authorization-via-add-note-to-call-log"
}
],
"title": "Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111938",
"datePublished": "2026-10-19T13:55:11.692Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T16:35:11.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111937 (GCVE-0-2026-111937)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 18:11
VLAI
EPSS
VEX
Title
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
Summary
Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/crm/security/advisories… | vendor-advisory |
| https://github.com/frappe/crm/commit/a24d73acefa7… | patch |
| https://github.com/frappe/crm/releases/tag/v1.81.2 | release-notes |
| https://github.com/frappe/crm/blob/v1.81.1/crm/ap… | technical-description |
| https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py | technical-description |
| https://github.com/frappe/crm/blob/v1.81.1/crm/fc… | technical-description |
| https://www.vulncheck.com/advisories/frappe-crm-b… | third-party-advisory |
Impacted products
Date Public
2026-09-08 07:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111937",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:08:36.415435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:11:17.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/frappe/crm",
"product": "crm",
"repo": "https://github.com/frappe/crm",
"vendor": "frappe",
"versions": [
{
"lessThan": "1.81.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.81.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-08T07:05:28.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users\u0027 CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others\u0027 notifications."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:10.989Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4rjw-6mxx-m345)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/crm/security/advisories/GHSA-4rjw-6mxx-m345"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/crm/commit/a24d73acefa7f98f46903858514444442ce57614"
},
{
"name": "Frappe CRM v1.81.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/frappe/crm/releases/tag/v1.81.2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/api/notifications.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/hooks.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/frappe/crm/blob/v1.81.1/crm/fcrm/doctype/crm_notification/crm_notification.json"
},
{
"name": "VulnCheck Advisory: Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-crm-before-1.81.2-missing-authorization-on-crm-notification-records"
}
],
"title": "Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111937",
"datePublished": "2026-10-19T13:55:10.989Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T18:11:17.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64862 (GCVE-0-2026-64862)
Vulnerability from cvelistv5 – Published: 2026-10-16 20:52 – Updated: 2026-10-19 16:40
VLAI
EPSS
VEX
Title
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/commit/6214ec8db13… | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/eefb8f4552d… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v15.58.3 | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.4.3 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64862",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:16.000160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:40:58.253Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.58.3"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.4.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:52:53.666Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx"
},
{
"name": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94"
},
{
"name": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v15.58.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v15.58.3"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.4.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.4.3"
}
],
"source": {
"advisory": "GHSA-wfc6-cw72-cvhx",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-64862",
"datePublished": "2026-10-16T20:52:53.666Z",
"dateReserved": "2026-07-20T18:31:39.291Z",
"dateUpdated": "2026-10-19T16:40:58.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55796 (GCVE-0-2026-55796)
Vulnerability from cvelistv5 – Published: 2026-10-16 20:50 – Updated: 2026-10-21 21:29
VLAI
EPSS
VEX
Title
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
Summary
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 21:28 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/frappe/hrms/commit/d823d20c494… | x_refsource_MISC |
| https://github.com/frappe/hrms/commit/e9eef454250… | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v15.60.3 | x_refsource_MISC |
| https://github.com/frappe/hrms/releases/tag/v16.7.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55796",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T21:28:58.555369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:29:08.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.60.3"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:50:01.927Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr"
},
{
"name": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6"
},
{
"name": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v15.60.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v15.60.3"
},
{
"name": "https://github.com/frappe/hrms/releases/tag/v16.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/hrms/releases/tag/v16.7.1"
}
],
"source": {
"advisory": "GHSA-c32r-q985-64xr",
"discovery": "UNKNOWN"
},
"title": "Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55796",
"datePublished": "2026-10-16T20:50:01.927Z",
"dateReserved": "2026-06-17T14:40:28.380Z",
"dateUpdated": "2026-10-21T21:29:08.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108373 (GCVE-0-2026-108373)
Vulnerability from cvelistv5 – Published: 2026-10-16 20:48 – Updated: 2026-10-19 21:26
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised access to financial data due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/commit/202f5227… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/24f0989a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.27.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:25:49.884889Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:26:03.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.118.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.27.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user\u0027s document permission match conditions. This allows the user to read financial data beyond the user\u0027s permitted role. This issue is fixed in versions 15.118.0 and 16.27.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:48:46.241Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6"
},
{
"name": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e"
},
{
"name": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.27.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.27.0"
}
],
"source": {
"advisory": "GHSA-rgrq-243c-c4g6",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised access to financial data due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108373",
"datePublished": "2026-10-16T20:48:46.241Z",
"dateReserved": "2026-10-09T21:36:27.042Z",
"dateUpdated": "2026-10-19T21:26:03.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108374 (GCVE-0-2026-108374)
Vulnerability from cvelistv5 – Published: 2026-10-16 20:38 – Updated: 2026-10-19 14:29
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised status modification due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:28 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/commit/547d82da… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/86e94803… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/a20fc4f9… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.34.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:28:27.458789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:29:00.708Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.121.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.34.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user\u0027s permitted role. This issue is fixed in versions 15.121.0 and 16.34.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:38:32.806Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7"
},
{
"name": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89"
},
{
"name": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03"
},
{
"name": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.121.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.121.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.34.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.34.0"
}
],
"source": {
"advisory": "GHSA-5wpj-6rvp-9ff7",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised status modification due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108374",
"datePublished": "2026-10-16T20:38:32.806Z",
"dateReserved": "2026-10-09T21:36:27.042Z",
"dateUpdated": "2026-10-19T14:29:00.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111389 (GCVE-0-2026-111389)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-18 12:03
VLAI
EPSS
VEX
Title
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
Summary
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:58 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-hrms-… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:58:31.282783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:03:17.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "14.38.2",
"status": "affected",
"version": "14.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "14.38.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.64.0",
"status": "affected",
"version": "15.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.64.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.18.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.18.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "utkusen"
},
{
"lang": "en",
"type": "finder",
"value": "asmitahase"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:57.752Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jfmr-9jv9-mrw4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4"
},
{
"name": "VulnCheck Advisory: Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-14.0.0-before-14.38.2-sql-injection-via-missing-validation"
}
],
"title": "Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111389",
"datePublished": "2026-10-16T01:17:57.752Z",
"dateReserved": "2026-10-15T21:55:44.538Z",
"dateUpdated": "2026-10-18T12:03:17.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111388 (GCVE-0-2026-111388)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 16:23
VLAI
EPSS
VEX
Title
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Summary
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:23 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:23:21.852545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:23:33.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "16.33.0",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.33.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.120.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.120.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.33.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.120.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "krupalvora"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:56.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h9jq-7pgf-hw8q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q"
},
{
"name": "VulnCheck Advisory: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.33.0-restrict-ip-allowlist-bypass-via-api-key-oauth-authentication"
}
],
"title": "Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111388",
"datePublished": "2026-10-16T01:17:56.859Z",
"dateReserved": "2026-10-15T21:55:44.538Z",
"dateUpdated": "2026-10-16T16:23:33.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55823 (GCVE-0-2026-55823)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:49 – Updated: 2026-10-13 17:51
VLAI
EPSS
VEX
Title
Frappe: Possibility of SQL injection in reportview
Summary
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:51 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40022 | x_refsource_MISC |
| https://github.com/frappe/frappe/pull/40027 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/49dbde746… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/f4f2df926… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.23.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:51:48.752488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:51:54.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:49:28.128Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7"
},
{
"name": "https://github.com/frappe/frappe/pull/40022",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40022"
},
{
"name": "https://github.com/frappe/frappe/pull/40027",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40027"
},
{
"name": "https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b"
},
{
"name": "https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-mf6r-q34j-pjw7",
"discovery": "UNKNOWN"
},
"title": "Frappe: Possibility of SQL injection in reportview"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55823",
"datePublished": "2026-10-13T16:49:28.128Z",
"dateReserved": "2026-06-17T16:29:38.864Z",
"dateUpdated": "2026-10-13T17:51:54.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66057 (GCVE-0-2026-66057)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:48 – Updated: 2026-10-14 15:37
VLAI
EPSS
VEX
Title
Frappe: Open Redirect via Unsanitized OAuth State Param.
Summary
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:37 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/pull/40962 | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/12568e2d5… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/1e0a3b941… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/6ed8acd86… | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v15.116.0 | x_refsource_MISC |
| https://github.com/frappe/frappe/releases/tag/v16.29.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:37:05.549194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:37:34.866Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.116.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.29.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:48:03.798Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-78c5-55xg-jm7m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-78c5-55xg-jm7m"
},
{
"name": "https://github.com/frappe/frappe/pull/40962",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/pull/40962"
},
{
"name": "https://github.com/frappe/frappe/commit/12568e2d54c4abba70bc0261387053fa28f90988",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/12568e2d54c4abba70bc0261387053fa28f90988"
},
{
"name": "https://github.com/frappe/frappe/commit/1e0a3b941231d74a71ff1a43eee2e9f63c88712d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/1e0a3b941231d74a71ff1a43eee2e9f63c88712d"
},
{
"name": "https://github.com/frappe/frappe/commit/6ed8acd869199feb3a2598887d471448297edf07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/6ed8acd869199feb3a2598887d471448297edf07"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v15.116.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v15.116.0"
},
{
"name": "https://github.com/frappe/frappe/releases/tag/v16.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/releases/tag/v16.29.0"
}
],
"source": {
"advisory": "GHSA-78c5-55xg-jm7m",
"discovery": "UNKNOWN"
},
"title": "Frappe: Open Redirect via Unsanitized OAuth State Param."
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66057",
"datePublished": "2026-10-13T16:48:03.798Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-10-14T15:37:34.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}