CVE-2026-47422 - Frappe: Unrestricted API access to save_report

Back Back to CVE browser

MEDIUM

Frappe: Unrestricted API access to save_report

Published Jul 10, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

Affected products

Vendor Frappe Product Frappe Default
n/a
- Version
  < 15.107.5
  Status
  affected
  Constraints
  -
- Version
  >= 16.0.0-beta.1, < 6.18.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Frappe

n/a

Version	Status	Constraints
< 15.107.5	affected	-
>= 16.0.0-beta.1, < 6.18.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43099
Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-43099		Advisory
https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248		x_refsource_CONFIRM