CVE-2026-58503CWE-203

Frappe: Unauthenticated User Enumeration via reset_password

Medium · published July 10, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
47.5
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00590 · 47.5th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-07-10T21:12Z
EPSS history
Timeline
  • 10 JUL 21:12Z
    Frappe: Unauthenticated User Enumeration via reset_password
    cvelistv5