Authentication Bypass in Frappe Framework

Executive Summary

This vulnerability exists in the Frappe web application framework, where an endpoint in the reportview component did not have proper permission checks before version 15.107.5 and 16.18.2.

Because of the missing permission checks, unauthorized users could potentially access data or functionality they should not have access to.

The issue has been fixed in versions 15.107.5 and 16.18.2 by adding the appropriate permission checks.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that unauthorized users might gain access to sensitive reports or data through the reportview endpoint due to the lack of proper permission checks.

This could lead to information disclosure or unauthorized data access, which may compromise the confidentiality of your application data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Frappe to version 15.107.5 or later, or 16.18.2 or later, where the permission check issue in the reportview endpoint has been fixed.

Useful 0 Not Useful 0