CVE-2026-66059

MediumCVSS 5.3

Published: 07/08/2026(UTC)Updated: 08/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Frappe is a full-stack web application framework. Prior to versions 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Risk Assessment

The risk includes unauthorized access to sensitive data fields, potentially leading to confidentiality breaches. It may also enable privilege escalation.

Recommendation

It is recommended to update to version 16.23.0 or 15.112.0 (or later) and to review field permission configurations. Also, monitor access logs for unusual requests.

Original NVD description (English source)

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.