Frappe Framework CVE-2026-44975

Exploitation requires a valid, active session in Frappe - any user account with the lowest privilege tier is sufficient (PR:L per CVSS 4.0 vector). No administrative or manager role is needed. The endpoint is reachable over the network (AV:N) and requires no interaction from other users (UI:N). There is no indication that a special configuration or non-default feature must be enabled; the onboarding subsystem appears to be part of the standard Frappe installation. The sole limiting factor is authentication: unauthenticated external attackers cannot exploit this flaw, and deployments where all Frappe users are fully trusted internal staff face substantially reduced residual risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium), reflecting network-accessible exploitation requiring only a low-privileged authenticated account, with no attack complexity or user interaction requirements. The impact is bounded to limited integrity (VI:L) with no confidentiality or availability effect, which is consistent with the nature of the flaw - it modifies onboarding metadata rather than exposing secrets or crashing services. EPSS at 0.02% (5th percentile) signals negligible observed or predicted exploitation activity, and there is no CISA KEV listing. No POC code is referenced in the advisory or tags. Overall, this is a genuine but low-urgency vulnerability: the authentication gate limits blast radius to insider or compromised-account scenarios, and the damage is disruptive (workflow interruption) rather than destructive (data loss or breach).

An attacker with any valid Frappe user account - such as a disgruntled employee or a user whose credentials were phished - authenticates to the application and sends a single crafted HTTP request to the unprotected onboarding reset endpoint. The server, lacking authorization checks, processes the request and resets onboarding state for every user in the instance, forcing all users through setup flows on next login and potentially disrupting business operations. No public exploit code is known to exist, making this scenario most realistic in an insider-threat context.