Frappe CVE-2026-39351

The CVSS 6.9 score reflects a network-adjacent vector with low complexity and low confidentiality impact. The CVSS 4.0 vector confirms unauthenticated access (PR:N), no user interaction (UI:N), and low confidentiality impact (VC:L), but notably no integrity or availability impact. The authentication bypass tag elevates real-world risk-this is not a zero-click vulnerability but does not require valid credentials, lowering barriers to exploitation. No EPSS score or active exploitation status (KEV) was provided in the intelligence, suggesting this may be a recently disclosed or pre-release advisory. However, the specific version constraints (16.14.0 and 15.104.0 as fixes) indicate the vendor has assessed and patched the issue. The vulnerability's focus on information disclosure via API abuse makes it a realistic priority for organizations running Frappe, particularly those exposing Frappe instances to untrusted networks. Organizations with strict network segmentation may face lower practical risk.

An unauthenticated attacker sends crafted HTTP requests to Frappe API endpoints (e.g., /api/resource/[Doctype]) without providing authentication credentials. The API layer fails to validate permissions and returns sensitive Doctype metadata or records that should be restricted. This allows the attacker to enumerate available document types and retrieve confidential application data such as customer lists, product catalogs, or configuration information without any valid user account. No special complexity or privilege escalation is required, and no proof-of-concept code needs to be crafted beyond standard API client tools.