Junglewise Threat Intelligence

CVE-2026-48127: Frappe Framework missing authorization in file-handling API

CVE-2026-48127 · Severity: info · CVSS 5.3 · Published 2026-07-10

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe Technologies.

Executive brief

Frappe is a web application framework used to build business software like ERPNext. A security flaw allowed users without proper permissions to attach files to any record type within the system. This could lead to unauthorized data being added to sensitive business records or the bypass of intended document management workflows.

Technical details

A missing authorization vulnerability (CWE-862) exists in the Frappe Framework's file-handling API. Specifically, endpoints such as 'add_attachments' and 'upload_file' failed to properly validate if the requesting user possessed write permissions for the target 'DocType' before allowing a file attachment. An authenticated attacker with low privileges could exploit this over the network to attach arbitrary files to any record, potentially bypassing business logic or storage restrictions. The vulnerability also affected guest upload configurations where restrictions on allowed DocTypes were not strictly enforced. The issue is resolved in versions 15.110.0 and 16.20.0 by hardening the file manager's permission checks.

Affected products

  • Frappe Technologies Frappe Framework < 15.110.0, >= 16.0.0-beta.1, < 16.20.0

Timeline

  • 2026-07-10: disclosed
  • 2026-07-10: advisory
  • 2026-05-27: patched: Fixes merged into main and backported to version 15/16 branches.

References

Related threats