# CVE-2026-44206: Frappe Framework DB schema enumeration via endpoint

Source: https://junglewise.ai/threats/cve-2026-44206-frappe-framework-db-schema-enumeration-via-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-44206 · Severity: info · CVSS 6.9 · Published 2026-06-12

Frappe, a web application framework, contains a vulnerability that allows unauthorized users to discover the internal structure of its database. By exploiting a specific web endpoint, an attacker can map out how data is organized, which is often a precursor to more advanced attacks like data theft. This issue has been resolved in the latest software updates.

Technologies: [Frappe Technologies Frappe Framework](https://junglewise.ai/threats/technologies/frappe-framework). Vendors: [Frappe Technologies](https://junglewise.ai/threats/vendors/frappe-technologies).

## Quick answers

**Is CVE-2026-44206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44206 being exploited in the wild.

**How severe is CVE-2026-44206?** Informational severity, with a CVSS score of 6.9, published 12 June 2026.

**Which products and versions are affected?** Frappe Technologies Frappe Framework < 15.107.2, < 16.17.4.

**Is there a fix for CVE-2026-44206?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44206?** Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Frappe Framework (prior to versions 15.107.2 and 16.17.4) allows for database schema enumeration. The flaw exists in a specific web endpoint that fails to properly restrict access or sanitize requests, enabling an unauthenticated remote attacker to gather information about the database structure (CWE-200). This information disclosure can be used to facilitate further targeted attacks against the application's data layer. The issue is addressed in versions 15.107.2 and 16.17.4.

## Affected products

- Frappe Frappe Framework < 15.107.2, < 16.17.4

## Timeline

- 2026-06-03: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: NVD publication date

## References

- [https://github.com/frappe/frappe/security/advisories/GHSA-9c55-cq5r-qj5x](https://github.com/frappe/frappe/security/advisories/GHSA-9c55-cq5r-qj5x)

## Related threats

- [Frappe Framework user enumeration in reset_password endpoint](https://junglewise.ai/threats/cve-2026-58503-frappe-framework-user-enumeration-in-reset-password-endpoint)
- [Frappe Framework missing authorization in file-handling API](https://junglewise.ai/threats/cve-2026-48127-frappe-framework-missing-authorization-in-file-handling-api)
- [Frappe Framework missing authorization in reportview](https://junglewise.ai/threats/cve-2026-47422-frappe-framework-missing-authorization-in-reportview)
- [Frappe Framework SQL injection via SELECT INTO OUTFILE in safe_exec](https://junglewise.ai/threats/cve-2026-47199-frappe-framework-sql-injection-via-select-into-outfile-in-safe)
- [Frappe path traversal in download_backups](https://junglewise.ai/threats/cve-2026-42219-frappe-path-traversal-in-download-backups)