Is CVE-2024-58390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-58390 being exploited in the wild.

How severe is CVE-2024-58390?

High severity, with a CVSS score of 8.8, published 12 October 2026.

Which products and versions are affected?

Frappe before 14.81.4 and 15.x before 15.41.0.

Is there a fix for CVE-2024-58390?

Yes: fixed in 14.81.4, 15.41.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-58390 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-58390?

Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-58390: Frappe privilege escalation via document action

CVE-2024-58390 · Severity: high · CVSS 8.8 · Published 2026-10-12

Frappe is a web application framework used to build business applications. An authenticated attacker with basic Website User access can escalate their privileges to System Manager (full administrator) through a vulnerability in document action handling. This grants the attacker complete control over the application and any data it manages.

Technologies: Frappe. Vendors: Frappe.

Quick answers

Is CVE-2024-58390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-58390 being exploited in the wild.
How severe is CVE-2024-58390?: High severity, with a CVSS score of 8.8, published 12 October 2026.
Which products and versions are affected?: Frappe before 14.81.4 and 15.x before 15.41.0.
Is there a fix for CVE-2024-58390?: Yes: fixed in 14.81.4, 15.41.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58390 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-58390?: Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 14.81.4, 15.41.0

Technical details

The vulnerability is an improper privilege management issue (CWE-269) in Frappe's document action handling that allows Website User-authenticated attackers to escalate to System Manager role. The attack requires authentication and additional steps beyond the document action alone, but no user interaction or network-level prerequisites. An attacker gains full administrative access to the Frappe instance.

Affected products

Frappe Frappe before 14.81.4 and 15.x before 15.41.0

Timeline

2024-12-17: disclosed
2024-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.