CVE-2026-39351

CriticalCVSS 9.1

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Frappe prior to versions 16.14.0 and 15.104.0 has a vulnerability allowing unrestricted Doctype access via API exploit.

An attacker can gain unauthorized access to all document types, potentially leading to data leakage or modification.

Update to version 16.14.0 or 15.104.0.

Original NVD description (English source)

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.