CVE-2026-124443

MEDIUM 4.3

Frappe before 16.35.0 Broken Access Control in File List/Report Queries

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

CWE	CWE-200
Vendor	frappe
Product	frappe
Published	Nov 8, 2026

Stay Ahead of the Next One

Get instant alerts for frappe frappe

Be the first to know when new medium vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

frappe / frappe

16.0.0 < 16.35.0

frappe / frappe

0 < 15.121.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/frappe/security/advisories/GHSA-7cxg-q8x5-rpjh vulncheck.com: https://www.vulncheck.com/advisories/frappe-before-16.35.0-broken-access-control-in-file-list-report-queries

Credits

AarDG10 anonymous123-ux-svg