Access Control Bypass in Frappe Framework by Frappe

CVE-2026-111388

What is CVE-2026-111388?

The Frappe Framework versions prior to 15.120.0 and 16.33.0 exhibit a security weakness where the per-user restrict_ip allowlist is not enforced for non-session authentication methods such as API key and OAuth. This flaw allows attackers with valid credentials to authenticate from unauthorized IP addresses, effectively circumventing configured network access restrictions. The absence of proper controls makes it imperative for users to upgrade to avoid potential exploitation.

References