Executive brief
Frappe is a web application framework used to build business applications. A flaw in its REST API allows authenticated users to read data from linked documents they don't have permission to access, potentially exposing sensitive business information like customer details, financial records, or internal data that should be restricted.
Technical details
This is an access control bypass vulnerability in Frappe's REST API when handling linked DocTypes. The framework fails to consistently enforce the linked DocType's own permission checks when records are retrieved through the REST API. An authenticated user with low privileges can exploit this by requesting linked documents through a REST endpoint, bypassing the permission model that would normally restrict access. The vulnerability affects versions prior to 15.115.0 and is resolved by updating to version 15.115.0 or later.
Affected products
- Frappe Frappe prior to 15.115.0
Timeline
- 2026-08-18: disclosed
- 2026-07-14: patched: Version 15.115.0 released
- 2026-08-26: advisory