CVE-2024-58390

Deferred Deferred - Pending Action

Improper Privilege Escalation in Frappe Application

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2024-58390

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

Frappe versions before 14.81.4 and 15.x before 15.41.0 have an improper privilege management flaw. This allows authenticated users with the Website User role to escalate privileges to System Manager by exploiting a specific document action and combining it with additional steps.

Detection Guidance

To detect this vulnerability, check the Frappe application version. If it is below 14.81.4 or 15.x below 15.41.0, it is likely vulnerable. Use commands like 'bench version' in the Frappe directory or check the version in the application's interface.

Impact Analysis

An attacker with Website User access could gain full administrative privileges in the Frappe application. This could lead to unauthorized data access, modification, or deletion, and potential compromise of the entire system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update Frappe to version 14.81.4 or later for version 14.x, or to 15.41.0 or later for version 15.x. Remove unnecessary Website User roles or restrict their permissions until the update is applied.

Hi! I’m here to help you understand CVE-2024-58390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70