CVE-2026-66003

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0 , an access control bypass in the REST API allows a low-privileged authenticated user to read data from Linked DocTypes they are not authorized to access. The root cause is that when a doc...