CVE-2024-27105: Frappe File Permissions can by bypassed using certain endpoints

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-21 · updated 2026-06-17
Weakness: CWE-863

Description

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds are available.

Affected products

frappe: before 14.66.3; from 15.0.0 before 15.16.0 — fixed in 14.66.3, 15.16.0

How to fix

Upgrade to a fixed version: frappe 14.66.3, 15.16.0. Check the vendor advisory for mitigations.

References

https://github.com/frappe/frappe/security/advisories/GHSA-hq5v-q29v-7rcw
https://github.com/frappe/frappe/security/advisories/GHSA-hq5v-q29v-7rcw

Get alerted when CVE-2024-27105 or the next vulnerability affects your stack