CVE-2026-29077

Published: Mar 5, 2026Modified: Mar 9, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Exploitability: 2.8 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

Affected (2)

Products: Frappe: Frappe

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Frappe Frappe	Before 14.100.0
Frappe Frappe	From 15.0.0 to 15.98.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

References (1)

https://github.com/frappe/frappe/security/advisories/GHSA-5h4c-9p23-4c3m

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.