CVE-2026-66003 in Frappe
Summary
by MITRE • 08/26/2026
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
Frappe serves as a comprehensive full-stack web application framework built upon Python and JavaScript, widely utilized for developing enterprise resource planning systems and other data-intensive applications. A significant security vulnerability was identified within the REST API implementation of this framework prior to version 15.115.0, specifically concerning access control mechanisms related to linked documents. This flaw represents a critical failure in authorization logic where the system fails to consistently enforce permissions associated with referenced records during retrieval operations. The issue stems from an inconsistency in how the framework handles security checks when a document contains Link fields that reference other documents within the database schema.
The technical nature of this vulnerability is classified as an access control bypass, specifically falling under CWE-284 Improper Access Control and aligning with MITRE ATT&CK technique T1078 Valid Accounts for lateral movement or data exfiltration scenarios where authenticated users exploit system logic flaws to escalate their effective privileges. When a user interacts with the REST API to retrieve a document that includes references to other documents via Link fields, the framework correctly validates permissions against the primary DocType but neglects to apply equivalent permission checks to the linked DocTypes. This oversight allows an attacker who possesses valid authentication credentials and basic access rights to one part of the application to indirectly read sensitive data from related records for which they have no explicit authorization.
The operational impact of this vulnerability is substantial, particularly in environments where Frappe is used to manage confidential business information such as financial records, human resources data, or customer personal details. An authenticated user with low-level privileges can exploit this flaw to perform unauthorized data disclosure by traversing relationships between documents. This capability effectively bypasses the intended isolation boundaries established by the application's role-based access control model. Consequently, sensitive fields from linked records become accessible without proper verification of whether the requesting user has permission to view that specific type of information, leading to potential privacy violations and compliance failures with regulations such as GDPR or HIPAA depending on the data involved.
Mitigation for this vulnerability requires an immediate upgrade to Frappe version 15.115.0 or any later release where the issue has been resolved. The fix ensures that permission checks are consistently applied not only to the primary document being accessed but also to all linked documents referenced within it during REST API operations. Administrators should verify their current framework version and apply updates through standard package management tools provided by the Frappe community. Additionally, organizations relying on this framework should implement rigorous input validation and review logging mechanisms to detect any anomalous access patterns that might indicate exploitation attempts while ensuring that all development teams adhere to secure coding practices that prioritize defense-in-depth strategies for data retrieval operations.