Executive brief
Frappe is a full-stack web application framework used to build business applications. The personal data download request feature contains a user enumeration vulnerability that allows attackers to discover which email addresses are registered in the system by observing differences in response formats between valid and invalid accounts.
Technical details
The vulnerability is a user enumeration issue in the PersonalDataDownloadRequest class (frappe/website/doctype/personal_data_download_request/personal_data_download_request.py). The public request-data web form returns distinguishable response shapes for registered versus unregistered email addresses, including the user_name field and different persistence behavior. An unauthenticated remote attacker can submit requests with various email addresses and compare responses to enumerate registered users. The issue is fixed in versions 15.115.0 and 16.27.0.
Affected products
- Frappe Frappe before 15.115.0 and 16.27.0
Timeline
- 2026-08-20: disclosed
- 2026-08: patched: Versions 15.115.0 and 16.27.0