What is the CVSS score of CVE-2026-29077?

CVE-2026-29077 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Frappe are affected by CVE-2026-29077?

A privilege escalation vulnerability in Frappe allows users to grant document access permissions they do not themselves possess, potentially exposing sensitive business data to unauthorized parties.

How to fix or mitigate CVE-2026-29077?

Within 24 hours: Identify all Frappe instances in your environment and document current versions. Within 7 days: Implement access logging and audit trails for document sharing activities; restrict document sharing permissions to administrators only if operationally feasible. Within 30 days: Prioritize upgrade to Frappe 15.98.0 or 14.100.0 or later; conduct access review to identify any unauthorized document shares that may have occurred.

Frappe CVE-2026-29077

HIGH

Improper Access Control (CWE-284)

2026-03-05 security-advisories@github.com

Authentication Bypass Frappe

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 21:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

AnalysisAI

Frappe versions prior to 15.98.0 and 14.100.0 contain an improper access control vulnerability that allows authenticated users to grant document permissions they do not possess to other users. An attacker with valid credentials could escalate privileges by sharing documents with elevated permissions, potentially exposing sensitive information or enabling unauthorized modifications. No patch is currently available.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Frappe. Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.