CVE-2026-29077CWE-284CWE-602

Frappe: Broken Access Control in DocShare

High · published March 5, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2026-03-05T20:22Z
EPSS history
Timeline
  • 05 MAR 20:22Z
    Frappe: Broken Access Control in DocShare
    cvelistv5