CVE-2026-48127: Frappe Framework missing authorization in file-handling API

CVE-2026-48127 · Severity: info · CVSS 5.3 · Published 2026-07-10

Frappe is a web application framework used to build business software like ERPNext. A security flaw allowed users without proper permissions to attach files to any record type within the system. This could lead to unauthorized data being added to sensitive business records or the bypass of intended document management workflows.

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe Technologies.

Quick answers

Is CVE-2026-48127 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48127 being exploited in the wild.
How severe is CVE-2026-48127?
Informational severity, with a CVSS score of 5.3, published 10 July 2026.
Which products and versions are affected?
Frappe Technologies Frappe Framework < 15.110.0, >= 16.0.0-beta.1, < 16.20.0.
Is there a fix for CVE-2026-48127?
A patch was published on 2026-05-27: Fixes merged into main and backported to version 15/16 branches. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48127 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48127?
Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the Frappe Framework's file-handling API. Specifically, endpoints such as 'add_attachments' and 'upload_file' failed to properly validate if the requesting user possessed write permissions for the target 'DocType' before allowing a file attachment. An authenticated attacker with low privileges could exploit this over the network to attach arbitrary files to any record, potentially bypassing business logic or storage restrictions. The vulnerability also affected guest upload configurations where restrictions on allowed DocTypes were not strictly enforced. The issue is resolved in versions 15.110.0 and 16.20.0 by hardening the file manager's permission checks.

Affected products

  • Frappe Technologies Frappe Framework < 15.110.0, >= 16.0.0-beta.1, < 16.20.0

Timeline

  • 2026-07-10: disclosed
  • 2026-07-10: advisory
  • 2026-05-27: patched: Fixes merged into main and backported to version 15/16 branches.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.