PT-2026-79108

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.115.0 Frappe versions prior to 16.27.0 Description The public request-data web form and the PersonalDataDownloadRequest class in frappe/website/doctype/personal data download request/personal data download request.p...

CVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-65974 ERPNext: Server-Side Template Injection leading to Remote Code Execution

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-72911

ERPNext has a server-side template injection vulnerability affecting the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. Unrestricted globals (including frappe.utils) allow an authenticated user with a common ...

CVE-2026-66000

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66000

Frappe (full-stack web framework) has an unrestricted access issue in Document Follow notifications prior to versions 16.23.0 and 15.112.0, where recipient permission checks are not re-evaluated for email data. This allows users whose access has been revoked or reduced to continue receiving docum...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66000

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

EUVD-2026-54573

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66058

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-66058

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-66058

CVE-2026-66058 affects the Frappe framework. Prior to versions 16.20.0 and 15.112.0 , an authenticated user could gain unrestricted access to the Document Follow API (update_follow). The issue is fixed in those versions. The available sources confirm the vulnerable behavior as an unauthorized/unr...

CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-66059

CVE-2026-66059 concerns the Frappe full‑stack web framework where, prior to versions 16.20.0 and 15.112.0 , a field‑level permissions bypass could expose restricted DocType fields. The underlying issue is a bypass of field permissions, enabling access to normally restricted data. The vulnerabilit...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...