CVE-2026-66059CWE-863broken-access-control

CVE-2026-66059

published August 7, 2026

CVSS

5.3

EPSS

Percentile

40.2

In the wild

Unconfirmed

What it is

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

The record

Technical detail

CVSS: 5.3 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00477 · 40.2th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-08-07T20:17Z

References (3)

https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4 · [email protected]https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9 · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4 · [email protected]

EPSS history

Timeline

07 AUG 15:21Z
Frappe: Field-level permission bypass via Document Follow
cvelistv5