CVE-2026-39351

Received Received - Intake

Unrestricted Doctype Access in Frappe API Enables Data Exposure

Publication date: 2026-04-07

Last updated on: 2026-04-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-07

Last Modified

2026-04-10

Generated

2026-07-06

AI Q&A

2026-04-07

EPSS Evaluated

2026-07-05

NVD

CVE-2026-39351

EUVD

EUVD-2026-19861

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 15.104.0 (exc)
frappe	frappe	From 16.0.0 (inc) to 16.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the frappe package to version 16.14.0 or later, or 15.104.0 or later, where the unrestricted Doctype access via API exploit has been patched.

Executive Summary

CVE-2026-39351 is a vulnerability in the Frappe web application framework that allows unrestricted access to Doctypes via an API exploit. This means that before versions 16.14.0 and 15.104.0, attackers could use the API to access Doctypes without proper authorization.

Impact Analysis

This vulnerability can lead to unauthorized data exposure or manipulation because attackers can access Doctypes through the API without restrictions. This could compromise sensitive information or allow malicious changes to data within the Frappe framework.

Compliance Impact

The vulnerability allows unauthorized access to Doctypes through the API, potentially leading to unauthorized data exposure or manipulation.

Such unauthorized access and potential data exposure could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive data.

Hi! I’m here to help you understand CVE-2026-39351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70