CVE-2024-58390
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
Risk Assessment
An authenticated low-privileged user can obtain administrative System Manager privileges. This leads to full privilege escalation and takeover of the application.
Recommendation
Update Frappe to version 14.81.4 or 15.41.0 (or later). Until patched, restrict Website User roles and monitor for unusual document actions.
Other vulnerabilities in Frappe
See all- CVE-2026-66057Medium
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
- CVE-2026-55823High
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.
- CVE-2025-68953High
Frappe, a full-stack web application framework, is vulnerable to path traversal attacks in versions 14.99.5 and below, and 15.0.0 through 15.80.1. Lack of proper sanitization on some requests allows arbitrary files to be retrieved from the server. This issue is fixed in versions 14.99.6 and 15.88.1.
- CVE-2017-1000120High
In Frappe versions up to 7.1.27, there is an SQL injection vulnerability in the frappe.share.get_users function that allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
- CVE-2026-39351Critical
Frappe prior to versions 16.14.0 and 15.104.0 has a vulnerability allowing unrestricted Doctype access via API exploit.
- CVE-2025-68929Critical
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
- CVE-2026-109602Medium
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.
- CVE-2026-109599Medium
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
- CVE-2025-71431Medium
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
- CVE-2025-71430Medium
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Original NVD description (English source)
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS