CVE-2026-39351
Received Received - Intake
Unrestricted Doctype Access in Frappe API Enables Data Exposure

Publication date: 2026-04-07

Last updated on: 2026-04-10

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-07
Last Modified
2026-04-10
Generated
2026-06-16
AI Q&A
2026-04-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-39351
EUVD
EUVD-2026-19861
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe to 15.104.0 (exc)
frappe frappe From 16.0.0 (inc) to 16.14.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should upgrade the frappe package to version 16.14.0 or later, or 15.104.0 or later, where the unrestricted Doctype access via API exploit has been patched.

Executive Summary

CVE-2026-39351 is a vulnerability in the Frappe web application framework that allows unrestricted access to Doctypes via an API exploit. This means that before versions 16.14.0 and 15.104.0, attackers could use the API to access Doctypes without proper authorization.

Impact Analysis

This vulnerability can lead to unauthorized data exposure or manipulation because attackers can access Doctypes through the API without restrictions. This could compromise sensitive information or allow malicious changes to data within the Frappe framework.

Compliance Impact

The vulnerability allows unauthorized access to Doctypes through the API, potentially leading to unauthorized data exposure or manipulation.

Such unauthorized access and potential data exposure could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39351. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart