CVE-2026-58503

Received Received - Intake

User Enumeration in Frappe Framework

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-58503

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 16.16.0 (exc)
frappe	frappe	to 15.106.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

Executive Summary

This vulnerability in the Frappe web application framework allows an attacker to perform user enumeration through the reset_password endpoint in versions prior to 16.16.0 and 15.106.0.

User enumeration means an attacker can determine whether a specific username or email exists in the system by analyzing the responses from the reset_password functionality.

This issue has been fixed in versions 16.16.0 and 15.106.0 of Frappe.

Impact Analysis

The vulnerability allows attackers to identify valid users in the system by exploiting the reset_password endpoint.

This can lead to targeted attacks such as phishing, password guessing, or brute force attacks against known user accounts.

While it does not directly allow password reset or account takeover, user enumeration can be a stepping stone for further malicious activities.

Mitigation Strategies

To mitigate this vulnerability, upgrade Frappe to version 16.16.0 or later, or version 15.106.0 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-58503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70