Frappe Framework: 18 Vulnerabilities Including Privilege Escalation Disclosed Together
Key findings • 18 vulnerabilities disclosed for Frappe Framework across multiple versions (13.x-16.x). • Critical privilege escalation flaw (CVE-2024-58390) allows Website User to become Syst…
Key findings
- 18 vulnerabilities disclosed for Frappe Framework across multiple versions (13.x-16.x).
- Critical privilege escalation flaw (CVE-2024-58390) allows Website User to become System Manager.
- Multiple authorization bypasses and access control issues affect sensitive data and actions.
- XSS and HTML injection vulnerabilities present due to improper input sanitization and escaping.
- Arbitrary file read, SSRF, and LDAP injection vulnerabilities also disclosed.
- Patches are available; users urged to update to specific fixed versions.
On October 11-12, 2026, a batch of 18 vulnerabilities was disclosed for the Frappe Framework, a popular open-source web framework primarily used for building business applications. The vulnerabilities span various versions of the framework, including 13.x, 14.x, 15.x, and 16.x, and were reported together, indicating a coordinated disclosure event. The issues range in severity from Low to High, with the most critical vulnerability (CVE-2024-58390) allowing privilege escalation from a Website User to System Manager.
Several vulnerabilities stem from insufficient authorization checks or improper access control. CVE-2026-109599, CVE-2026-109598, CVE-2023-54411, CVE-2023-54410, CVE-2023-54412, CVE-2023-54410, and CVE-2026-108734 all relate to flaws where authenticated users could access or modify data beyond their intended permissions. Specifically, CVE-2023-54411 allows any non-guest user to create and edit email templates, while CVE-2024-58390 enables a Website User to escalate privileges to System Manager. CVE-2026-108734 in Frappe CRM allows unauthorized access to linked documents.
Cross-site scripting (XSS) and HTML injection vulnerabilities are also present in this batch. CVE-2026-109602 and CVE-2025-71430 describe stored XSS flaws in dashboard chart filters and the leaderboard page, respectively, where crafted user inputs execute scripts in other users' browsers. CVE-2024-58391 and CVE-2023-54409 are XSS vulnerabilities in printview and through the html2text function, respectively, exploiting unescaped user input. CVE-2023-54408 is an HTML injection vulnerability due to weak escaping of user-supplied content.
Further vulnerabilities include an arbitrary file read flaw (CVE-2026-109601) where attackers can expose sensitive server files by supplying crafted email content. CVE-2026-109603, a low-severity issue, leverages a vulnerable pdfkit library to enable server-side request forgery and local file inclusion. An LDAP injection vulnerability (CVE-2025-71431) exists due to unsanitized user-supplied parameters in LDAP queries. Additionally, CVE-2026-109600 highlights a flaw where disabled users continue to receive email notifications, and CVE-2023-54407 allows users with error log access to view sensitive information in tracebacks. Finally, CVE-2023-54406 describes a sandbox flaw in Server Script execution that could be exploited by privileged users.
The disclosed vulnerabilities affect various versions of Frappe Framework. Patches are available for specific versions, with users advised to update to the patched releases to mitigate these risks. For instance, Frappe Framework 15.107.3 and 16.17.0 address CVE-2026-109603, while CVE-2026-109602 is fixed in 15.118.0 and 16.31.0. Users should consult the specific version numbers provided in the vulnerability descriptions to ensure they apply the correct patches.
This extensive batch of vulnerabilities underscores the importance of regular security updates for Frappe Framework users. The range of issues, from privilege escalation to XSS and information disclosure, highlights potential attack vectors that could compromise application integrity and user data. Promptly applying patches is crucial to protect against these threats.