CVE-2026-47422CWE-862

Frappe: Unrestricted API access to save_report

Medium · published July 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00381 · 30.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-10T21:09Z
EPSS history
Timeline
  • 10 JUL 21:09Z
    Frappe: Unrestricted API access to save_report
    cvelistv5