What’s Vulnerable › Vulnerabilities

CVE-2026-66059: Frappe: Field-level permission bypass via Document Follow

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-07 · updated 2026-09-08
• Weakness: CWE-863

Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Affected products

• frappe: from 16.0.0-beta.1, < 16.20.0; before 15.112.0

References

• https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4
• https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9
• https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4

Get alerted when CVE-2026-66059 or the next vulnerability affects your stack