CVE-2026-124443

EUVD-2026-119557
Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
frappefrappe
16.0.0 ≤
𝑥
< 16.35.0
CNA
frappefrappe
𝑥
< 15.121.1
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/security/advisories/GHSA-7cxg-q8x5-rpjh
https://www.vulncheck.com/advisories/frappe-before-16.35.0-broken-access-control-in-file-list-report-queries