What’s Vulnerable › Vulnerabilities
CVE-2026-47422: Frappe: Unrestricted API access to save_report
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-10 · updated 2026-07-14
- Weakness: CWE-862
Description
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.
Affected products
- frappe: before 15.107.5; from 16.0.0-beta.1, < 6.18.2
References
Get alerted when CVE-2026-47422 or the next vulnerability affects your stack