← All advisories

Critical severity9.1NVD Advisory· Published Apr 7, 2026· Updated Apr 10, 2026

CVE-2026-39351

CVE-2026-39351

Description

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Frappe/Frappe2 versions
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*range: <15.104.0
- (no CPE)range: >=0.0.0, <=15.104.0; >=16.0.0.0.0, <16.14.0

Patches

Vulnerability mechanics

References

1

github.com/frappe/frappe/security/advisories/GHSA-8ggw-hfr6-rw3xnvdVendor Advisory

News mentions

0

No linked articles in our index yet.