CVE-2026-66002 in Frappe
Summary
by MITRE • 08/20/2026
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within the Frappe web application framework constitutes a classic information disclosure flaw rooted in inconsistent response handling for authentication-related endpoints. Specifically, this issue affects the public request-data web form and the PersonalDataDownloadRequest class located at frappe/website/doctype/personal_data_download_request/personal_data_download_request.py prior to versions 15.115.0 and 16.27.0. The core technical flaw lies in the application's failure to implement uniform response structures for both registered and unregistered email addresses when processing personal data download requests. Instead of returning an identical, generic success or informational message regardless of whether the provided email corresponds to a valid user account, the system returns distinguishable responses that vary based on the existence of the associated user record.
This discrepancy manifests primarily through differences in the returned JSON structure and specific field values, most notably the presence or absence of the user_name field, as well as variations in persistence behavior such as database logging patterns or session handling artifacts. By submitting a series of requests with different email addresses to this endpoint, an attacker can analyze these subtle but detectable differences in the server's replies. If one response includes specific metadata indicating successful processing for a known entity while another returns a structurally distinct payload implying no action was taken due to lack of records, the attacker gains definitive proof that the former email is associated with an active account on the platform. This technique allows for efficient user enumeration without requiring any form of authentication or prior knowledge of valid credentials.
From a security architecture perspective, this vulnerability aligns directly with CWE-203: Observable Discrepancy and CWE-204: Observable Response Disparity. These categories describe scenarios where an application inadvertently leaks information through differences in output that should be indistinguishable to external observers. In the context of modern attack frameworks, such as MITRE ATT&CK, this behavior facilitates reconnaissance activities categorized under T1589.001: Gather Victim Identity Information - Email Addresses. The ability to enumerate valid email addresses serves as a critical precursor step for more severe attacks, including targeted phishing campaigns known as spear-phishing or credential stuffing attempts against the identified accounts. By confirming which emails are active, attackers can prioritize their efforts and increase the likelihood of successful compromise by focusing on verified targets rather than guessing blindly.
The operational impact of this vulnerability extends beyond simple user enumeration. It undermines the principle of least privilege regarding information exposure and compromises the confidentiality of the application's user base. For organizations relying on Frappe for sensitive operations, such as customer relationship management or internal enterprise resource planning, exposing valid employee or client email addresses can lead to reputational damage and increased risk of social engineering attacks. Furthermore, if these enumerated accounts are linked to other services through credential reuse, the breach may have cascading effects across an organization's broader digital infrastructure. The persistence behavior mentioned in the vulnerability description suggests that repeated requests might leave traces in logs or database entries, potentially aiding attackers in refining their enumeration strategies over time without triggering immediate rate-limiting alarms if not properly monitored.
To mitigate this risk, organizations must upgrade to Frappe version 15.115.0 or later, where the developers have addressed the inconsistency by ensuring that responses for both registered and unregistered emails are structurally identical. This normalization of response payloads removes the side channel through which user enumeration was previously possible. In addition to upgrading, security teams should implement robust rate limiting on public-facing endpoints related to personal data requests to prevent automated scanning tools from efficiently enumerating large volumes of email addresses in a short timeframe. Monitoring server logs for patterns indicative of bulk submission attempts can also provide an additional layer of defense by alerting administrators to potential enumeration attacks before significant damage occurs. Ensuring that all authentication and identity-related endpoints adhere to strict response uniformity standards is essential for maintaining the integrity of user privacy and preventing reconnaissance-based exploits in web applications built on this framework.