High severity8.8NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2024-58390

Description

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Frappellm-fuzzy
Range: <14.81.4, <15.41.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-gjqf-v2f6-962hnvd
www.vulncheck.com/advisories/frappe-before-15.41.0-privilege-escalation-via-document-actionnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000