CVE-2026-47765

UNKNOWN 0.0

Frappe: Lack of Permissions in restore/bulk_restore

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.

CWE	CWE-862
Vendor	frappe
Product	frappe
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for frappe frappe

Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frappe / frappe

< 15.110.0 >= 16.0.0-beta.1, < 16.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf github.com: https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e github.com: https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0