CVE-2026-47765CWE-862broken-access-control

CVE-2026-47765

published August 7, 2026

CVSS
7.1
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-07T02:17Z
References (3)
https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e · [email protected]https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0 · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf · [email protected]
EPSS history
Timeline
  • 06 AUG 21:25Z
    Frappe: Lack of Permissions in restore/bulk_restore
    cvelistv5