Is there a patch available for CVE-2026-44206?

Yes, a patch is available for CVE-2026-44206. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-44206

Q: What is the CVSS score of CVE-2026-44206?

CVE-2026-44206 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36490 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible with no auth required per CVSS 4.0 source vector; only low confidentiality impact with no integrity, availability, or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:29 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.

AnalysisAI

DB schema enumeration in Frappe (versions prior to 15.107.2 and 16.17.4) exposes internal database structure to unauthenticated remote attackers via a vulnerable endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, making this accessible to any internet-facing instance. While limited to low confidentiality impact (VC:L) with no integrity or availability consequences, schema information can inform targeted follow-on attacks against the application's data layer. No public exploit has been identified at time of analysis, and EPSS of 0.02% (7th percentile) indicates low current exploitation probability.

Technical ContextAI

Frappe is a Python/JavaScript full-stack web application framework used to build business applications, most notably ERPNext. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to Unauthorized Actor), indicating that an application endpoint fails to restrict access to sensitive metadata - in this case, the database schema, which includes table names, column names, and potentially data types. CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* indicates all Frappe versions across both the v15 and v16 branches are affected prior to the respective fix releases. Schema enumeration is a reconnaissance capability: knowing the underlying DB structure allows an attacker to craft more precise injection payloads, identify sensitive data stores, or map application logic without direct database access.

RemediationAI

Upgrade Frappe to version 15.107.2 (v15 branch) or 16.17.4 (v16 branch) as documented in the vendor security advisory at https://github.com/frappe/frappe/security/advisories/GHSA-9c55-cq5r-qj5x. These are the vendor-confirmed patched versions. If an immediate upgrade is not feasible, restrict access to the vulnerable endpoint at the reverse proxy or WAF layer - identify and block the specific API endpoint triggering schema enumeration (the advisory should detail which endpoint is affected). Limiting unauthenticated API surface to authenticated-only access via Frappe's built-in permission system or an API gateway is a viable compensating control, though it may break integrations relying on public endpoint access. Network-layer controls such as IP allowlisting for the Frappe admin interface reduce exposure to untrusted clients.