Access Control Bypass in Frappe Framework Affects User Data Security
CVE-2026-66003

7.1HIGH

Key Information:

Vendor

Frappe

Status
Frappe
Vendor
CVE Published:
26 August 2026

What is CVE-2026-66003?

The Frappe Framework, a full-stack web application framework developed in Python and JavaScript, contains an access control bypass vulnerability in its REST API. This flaw allows authenticated users with low privileges to read sensitive data from Linked DocTypes, circumventing the intended permission restrictions. When linking documents through a Link field, the framework fails to apply the necessary permissions consistently when retrieving records via the REST API. Consequently, unauthorized access to fields from linked documents is possible, exposing user data to those without appropriate authorization. The issue has been addressed in version 15.115.0.

Affected Version(s)

frappe < 15.115.0

References

https://github.com/frappe/frappe/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/frappe/frappe/releases/tag/v15.115.0
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.