Is there a patch available for CVE-2026-44208?

Yes, a patch is available for CVE-2026-44208. Update the affected software to the latest version immediately.

Frappe CVE-2026-44208

Q: What is the CVSS score of CVE-2026-44208?

CVE-2026-44208 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36485 MEDIUM

Improper Access Control (CWE-284)

2026-06-12 GitHub_M

Authentication Bypass Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint requiring no complexity; scope unchanged with only low integrity impact and zero confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:16 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of validations in the "submit_discussion()" endpoint allows for unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

AnalysisAI

Unauthorized resource access in the Frappe web application framework exposes the submit_discussion() endpoint to unauthenticated network callers who can bypass access controls and write discussion data to resources they do not own. All Frappe deployments running versions prior to 15.107.0 (v15 branch) or 16.17.0 (v16 branch) are affected, with impact limited to low-severity integrity writes and no confidentiality or availability consequence. No public exploit code exists and EPSS probability is 0.03% (9th percentile), indicating low opportunistic exploitation pressure despite the unauthenticated network attack vector.

Technical ContextAI

Frappe is an open-source Python and JavaScript full-stack web application framework that underpins enterprise applications such as ERPNext. The vulnerable component, submit_discussion(), is a server-side endpoint responsible for handling discussion or comment submissions associated with document resources within the Frappe document model. CWE-284 (Improper Access Control) identifies the root cause: the endpoint performs no server-side validation to confirm whether the requesting principal holds the necessary permission to submit a discussion against the targeted resource, effectively treating any caller as authorized. The affected CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* spans all Frappe versions across both the v15 and v16 release lines, with fixes introduced at the specific patch releases named in the advisory.

RemediationAI

Upgrade Frappe to version 15.107.0 or later on the v15 release branch, or to version 16.17.0 or later on the v16 release branch, as documented in GitHub Security Advisory GHSA-xh7m-j2j2-82f2 at https://github.com/frappe/frappe/security/advisories/GHSA-xh7m-j2j2-82f2. No official interim workaround is documented in the advisory. If immediate patching is not feasible, consider placing the Frappe application behind a reverse proxy that requires authentication for all routes, which would neutralize the PR:N attack vector at the cost of breaking any intentionally public-facing functionality. Additionally, deploying network-layer access controls (firewall rules, VPN enforcement) to limit who can reach the application reduces exposure. Log monitoring for unexpected or high-frequency unauthenticated POST requests to the submit_discussion() endpoint can serve as a detection compensating control.