OAuth2 Vulnerability in Frappe Framework Affects User Data Security
CVE-2026-66001

8.5HIGH

Key Information:

Vendor

Frappe

Status
Frappe
Vendor
CVE Published:
20 August 2026

What is CVE-2026-66001?

The Frappe Framework contains a vulnerability in its OAuth2 implementation, allowing the consent flow to proceed without properly enforcing POST requests, validating csrf_tokens, or scoping active OAuth token checks to the requesting client. This oversight can enable an attacker to manipulate an authenticated user's approvals, potentially granting unauthorized access to sensitive data and actions within the scope of permissions. Users are advised to upgrade to versions 15.114.0 or 16.26.0 to mitigate this risk.

Affected Version(s)

frappe < 15.114.0 < 15.114.0

frappe >= 16.0.0-beta.1, < 16.26.0 < 16.0.0-beta.1, 16.26.0

References

https://github.com/frappe/frappe/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/40073
x_refsource_MISC
https://github.com/frappe/frappe/pull/40700
x_refsource_MISC

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.