CVE-2026-58503: Frappe Framework user enumeration in reset_password endpoint

CVE-2026-58503 · Severity: info · CVSS 6.9 · Published 2026-07-10

Frappe is a web application framework used to build business software like ERPNext. A flaw in the password reset feature allowed unauthorized individuals to determine if specific email addresses were registered users of the system. This type of information can be used to facilitate targeted phishing or brute-force attacks against your employees or customers.

Technologies: Frappe Technologies Frappe Framework. Vendors: Frappe Technologies.

Quick answers

Is CVE-2026-58503 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58503 being exploited in the wild.
How severe is CVE-2026-58503?
Informational severity, with a CVSS score of 6.9, published 10 July 2026.
Which products and versions are affected?
Frappe Technologies Frappe Framework < 15.106.0, >= 16.0.0-beta1, < 16.16.0.
Is there a fix for CVE-2026-58503?
A patch was published on 2026-04-21: Versions 15.106.0 and 16.16.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58503 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58503?
Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A user enumeration vulnerability exists in Frappe Framework's reset_password endpoint due to an observable discrepancy (CWE-203). Prior to the fix, the application returned different responses or confirmation messages depending on whether the submitted email address existed in the database. An unauthenticated remote attacker could exploit this by submitting a list of email addresses and observing the responses to identify valid accounts. The fix ensures that the application returns a consistent confirmation message regardless of whether the email address is registered. This has been patched in versions 15.106.0 and 16.16.0.

Affected products

  • Frappe Technologies Frappe Framework < 15.106.0, >= 16.0.0-beta1, < 16.16.0

Timeline

  • 2026-04-15: other: Fixes developed and backported in GitHub pull requests
  • 2026-04-21: patched: Versions 15.106.0 and 16.16.0 released
  • 2026-07-10: disclosed: CVE-2026-58503 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.