Medium severity4.3NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-124443

Description

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

Affected products

Frappe/Frappe Frameworkllm-fuzzy
Range: <15.121.1, <16.35.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/security/advisories/GHSA-7cxg-q8x5-rpjhnvd
www.vulncheck.com/advisories/frappe-before-16.35.0-broken-access-control-in-file-list-report-queriesnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000