CVE-2026-50026
Deferred Deferred - Pending Action
Permission Bypass in Frappe Framework

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-50026
EUVD
EUVD-2026-36458
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
frappe frappe_framework to 16.17.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The CVE-2026-50026 vulnerability is due to a lack of permission checks in the 'relink' and 'set_email_password' endpoints of the Frappe Framework. This flaw allowed unauthorized users to access resources without proper authorization.

It affects versions of Frappe Framework prior to v16.17.0 and v15.107.0, and has been patched in these versions.

Impact Analysis

This vulnerability can allow unauthorized users to access resources that should be protected, potentially leading to unauthorized data exposure or manipulation.

Since the flaw exists in permission checks, attackers could exploit it without any authentication, increasing the risk of unauthorized access.

The severity of this vulnerability is classified as Moderate.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Frappe Framework to version 15.107.0 or 16.17.0 or later, where the issue has been patched.

There are no available workarounds, so applying the update is the only effective mitigation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50026. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart