CVE-2024-58390 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 14.81.4 and version 15.x prior to 15.41.0. This vulnerability is classified as an improper privilege management issue, which fundamentally undermines the integrity of the application's access control mechanisms. The core technical flaw involves a specific document action that fails to enforce appropriate role-based restrictions during its execution. While this action is ostensibly designed for users with limited privileges, such as those holding the Website User role, it inadvertently provides a pathway for privilege escalation. This misconfiguration allows an authenticated attacker who possesses only basic website user access to manipulate system processes in ways intended exclusively for high-privilege accounts.
The operational impact of this vulnerability is severe due to its potential to result in full administrative compromise of the Frappe application environment. By leveraging the flawed document action, attackers can escalate their privileges from a low-level Website User role directly to that of a System Manager. The System Manager role typically holds unrestricted access within the framework, granting control over user accounts, system configurations, data integrity, and potentially server-side resources depending on how the Frappe instance is deployed. This escalation effectively bypasses all intended security boundaries, allowing malicious actors to perform actions such as creating new administrative users, modifying critical application settings, accessing sensitive database records, or executing arbitrary code if further exploitation vectors are present within the elevated context.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management. This category encompasses situations where an actor is able to execute actions that exceed their assigned permissions level. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques related to Account Manipulation and Permission Groups Modification, specifically under the tactic of Persistence or Impact depending on the attacker's ultimate goal after gaining System Manager access. The ability to transition from a public-facing role to an administrative one highlights a critical failure in the principle of least privilege, where components are granted only the minimum levels of access necessary for their function.
To mitigate this risk, organizations running Frappe must immediately upgrade to version 14.81.4 or later, or if using the v15 branch, ensure they have applied patches up to at least version 15.41.0. These releases contain the necessary code corrections that enforce strict role verification during the execution of the affected document actions. Until an upgrade is feasible, administrators should consider implementing compensating controls such as restricting access to specific endpoints via web application firewalls or network-level ACLs if those endpoints are not required for public-facing operations. Additionally, rigorous monitoring of user activity logs for unusual privilege escalation attempts can aid in early detection of exploitation efforts. Regular security audits and adherence to secure coding practices that validate permissions at every step of a transaction are essential preventive measures against similar vulnerabilities in the future.