CVE-2026-66002
Received Received - Intake

User Enumeration in Frappe Framework

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-66002
EUVD
EUVD-2026-63541

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
frappe frappe 15.115.0
frappe frappe 16.27.0
frappe frappe to 15.115.0 (exc)
frappe frappe to 16.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Frappe Framework allows attackers to determine if an email address is registered in the system by exploiting distinguishable responses from the Personal Data Download Request (PDDR) feature. Before versions 15.115.0 and 16.27.0, the system returned different responses for registered and unregistered emails, including the user_name field and persistence behavior. Attackers could compare these responses to enumerate valid user accounts.

Detection Guidance

This vulnerability can be detected by checking the response from the Personal Data Download Request (PDDR) form. If the response includes the user_name field or varies between registered and unregistered email addresses, the system may be vulnerable. Use tools like curl to send test requests to the PDDR endpoint with different email addresses and compare responses.

Impact Analysis

This vulnerability enables attackers to identify registered users in the system, which can lead to targeted phishing attacks, brute force attempts, or enumeration of valid accounts for further exploitation. It compromises user privacy by exposing which email addresses are associated with active accounts.

Compliance Impact

This vulnerability may violate privacy regulations like GDPR and HIPAA by exposing user registration status without consent. GDPR requires data minimization and protection of personal data, while HIPAA mandates safeguards against unauthorized disclosure of protected health information. The exposure of user enumeration conflicts with these requirements.

Mitigation Strategies

Immediately update Frappe Framework to version 15.115.0 or 16.27.0 or later. There are no workarounds available, so updating is the only mitigation. Verify the update by checking the response from the PDDR form to ensure it no longer exposes user_name or varies based on email registration status.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart