CVE-2026-66059

UNKNOWN 0.0

Frappe: Field-level permission bypass via Document Follow

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

CWE	CWE-863
Vendor	frappe
Product	frappe
Published	Aug 7, 2026

Stay Ahead of the Next One

Get instant alerts for frappe frappe

Be the first to know when new unknown vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frappe / frappe

>= 16.0.0-beta.1, < 16.20.0 < 15.112.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4 github.com: https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4 github.com: https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9