VYPR
Vypr IntelligenceAI-generatedAug 20, 2026· 5 CVEs

Frappe Framework: Five Vulnerabilities Including High-Severity Flaws Disclosed Together

Five vulnerabilities, including two high-severity flaws, were disclosed for the Frappe web application framework on August 20, 2026, impacting access control and data validation.

Key findings

  • Five vulnerabilities in Frappe disclosed simultaneously on August 20, 2026.
  • High severity flaws include insecure OAuth2 flow and bypassed client-side validation.
  • Medium severity issues involve information leakage and improper permission checks.
  • Affected versions include releases prior to 15.115.0, 16.27.0, 16.26.0, and 16.31.0.
  • Patches are available for all disclosed vulnerabilities.

On August 20, 2026, a batch of five vulnerabilities was disclosed for the Frappe web application framework. These vulnerabilities, spanning medium and high severity, were all published simultaneously, indicating a coordinated disclosure event. The issues primarily revolve around improper access controls and insufficient validation within various Frappe modules, potentially allowing authenticated users to perform unauthorized actions or access sensitive information.

Several vulnerabilities stem from insecure handling of web requests and API endpoints. CVE-2026-66002, a medium-severity flaw, arises from distinguishable response shapes for registered and unregistered emails in the public request-data web form and PersonalDataDownloadRequest class. This could allow attackers to infer information about user registrations.

Another significant issue, CVE-2026-66001 (High), involves the OAuth2 consent flow. The approve and authorize functions in frappe/integrations/oauth2.py could proceed without proper restrictions, such as lacking a CSRF token in the oauth_confirmation.html template and not restricting approval to POST requests. This could potentially lead to unauthorized actions within the OAuth2 flow.

Furthermore, issues related to state-changing operations were identified. CVE-2026-63654 (Medium) highlights that the bulk_workflow_approval endpoint in frappe/model/workflow.py accepted safe HTTP methods, not just POST, enabling state-changing workflow approvals without proper authorization. Similarly, CVE-2026-53569 (Medium) describes how the toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py did not enforce read permissions, allowing authenticated users to modify metadata without authorization.

A critical vulnerability, CVE-2026-62315 (High), was found in frappe/client.py. The frappe.client.set_value function had a flaw where it checked a dictionary against forbidden fields only after parsing it into individual field names. This allowed an authenticated caller to bypass security checks and potentially modify sensitive data.

The disclosed vulnerabilities affect Frappe versions prior to 15.115.0 and 16.27.0 for CVE-2026-66002, prior to 15.114.0 and 16.26.0 for CVE-2026-66001, and version 16.31.0 and earlier for CVE-2026-63654, CVE-2026-62315, and CVE-2026-53569. Users are advised to update to the patched versions to mitigate these security risks. This batch of vulnerabilities underscores the importance of rigorous access control and input validation in web application frameworks.

The immediate impact for Frappe users is the potential for unauthorized data access or modification by authenticated users due to insufficient permission checks and improper handling of web requests. Staying updated with the latest security patches is crucial for maintaining the integrity and security of applications built on the Frappe framework.

The vulnerabilities were disclosed on August 20, 2026. The affected versions are:

Users should update to the latest available versions to address these security concerns.

The batch of vulnerabilities disclosed on August 20, 2026, for the Frappe framework highlights critical security weaknesses in access control and request handling. These five CVEs, ranging from medium to high severity, were published simultaneously, emphasizing the need for prompt patching by Frappe users. The issues include improper validation in web forms, insecure OAuth2 flows, and insufficient permission checks on state-changing endpoints, all of which could be exploited by authenticated attackers.

The vulnerabilities are:

  • CVE-2026-66002 (Medium): Distinguishable response shapes for registered/unregistered emails.
  • CVE-2026-66001 (High): Insecure OAuth2 consent flow without proper restrictions.
  • CVE-2026-63654 (Medium): Workflow approval endpoint accepting non-POST methods.
  • CVE-2026-62315 (High): Bypassed security checks in frappe.client.set_value.
  • CVE-2026-53569 (Medium): Lack of read permission enforcement on metadata modification endpoints.

The affected versions are:

Users are strongly urged to update their Frappe installations to the patched versions to protect against these vulnerabilities. This coordinated disclosure serves as a reminder for developers to prioritize security best practices in framework development.

AI-written article. Grounded in 5 CVE records listed below.