277938 matches found
CVE-2026-17475 IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...
CVE-2026-17475
IBM Planning Analytics versions 2.0 and 2.1 are affected by a security vulnerability where a remote authenticated attacker can delete folders and applications belonging to other users. This is caused by improper functional level access control (CWE-285). The vulnerability has a High base severity...
CVE-2026-17475 IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the absence of CSRF protection on state-changing endpoints when OAuth cookie-based authentication is in use. An attacker can trick an authenticated user into visiting a malicious page that issues forg...
CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...
CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...
CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the getmailboxes and getquota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names,...
CVE-2026-109675
The Frappe Suite (versions before commit 2697564a9c46da6acc614743eaf9915fe5238f4f ) is vulnerable to a broken access control flaw in the get_mailboxes and get_quota APIs. This vulnerability allows authenticated mail users to access the data of other users by supplying a different user's JMAP acco...
CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...
CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...
CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...
CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...
CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...
CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...
CVE-2026-109600
The Frappe Framework is affected by an improper access control vulnerability in its Document Follow email notifications system. Specifically, versions before 15.118.0 and 16.x before 16.31.0 fail to verify if a user account is disabled before sending automated email updates. As a result, a disabl...
CVE-2023-54412
The Frappe application (versions before 13.46.3 and 14.x before 14.21.1 ) contains an improper access control vulnerability within the Email Template permissions. This flaw allows any authenticated non-guest user , including low-privileged self-registered users, to create and edit any Email Templ...
CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...
CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...
CVE-2023-54412 Frappe before 13.46.3 Improper Access Control for Email Templates
Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is...
