CVE-2026-66003

Received Received - Intake

Access Control Bypass in Frappe Framework REST API

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-66003

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	15.115.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an access control bypass in the Frappe framework's REST API. It allows low-privileged authenticated users to read data from Linked DocTypes they are not authorized to access. The issue occurs because the framework does not consistently enforce permissions on linked records when retrieved via the REST API.

Detection Guidance

To detect this vulnerability, check if your Frappe framework version is below 15.115.0. Use the command: bench version. If the version is older, the system is vulnerable. Additionally, review REST API logs for unauthorized data access patterns involving Linked DocTypes.

Impact Analysis

An attacker with low privileges could exploit this to access sensitive data they should not be able to see, such as confidential records or user information. This could lead to data breaches, unauthorized data exposure, or compliance violations depending on the data accessed.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations that require strict access controls and data protection. Unauthorized data exposure may result in legal penalties, fines, or reputational damage for organizations using affected Frappe versions.

Mitigation Strategies

Upgrade Frappe to version 15.115.0 or later to address the access control bypass in the REST API.

Hi! I’m here to help you understand CVE-2026-66003. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70