Is there a patch available for CVE-2026-44976?

Yes, a patch is available for CVE-2026-44976. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-44976

Q: What is the CVSS score of CVE-2026-44976?

CVE-2026-44976 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36493 MEDIUM

Improper Access Control (CWE-284)

2026-06-12 GitHub_M

Authentication Bypass Frappe

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible, low-complexity write bypass requiring only a valid user session (PR:L); no confidentiality or availability impact, only low integrity impact on Onboarding Step records.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:29 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.

AnalysisAI

Improper access control in Frappe prior to 16.17.4 permits any authenticated user to modify any field in any Onboarding Step record, bypassing expected privilege restrictions. Affected deployments running versions below 16.17.4 expose their onboarding configuration data to unauthorized tampering by low-privileged users. EPSS is extremely low (0.02%, 5th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, suggesting no observed active exploitation at time of analysis.

Technical ContextAI

Frappe is a Python-based full-stack web application framework widely used to build ERPNext and other business applications. The vulnerability is classified as CWE-284 (Improper Access Control), indicating that the framework's permission enforcement layer does not correctly restrict write operations on the Onboarding Step doctype to privileged roles. Instead of validating that the requesting user holds the necessary System Manager or equivalent role before allowing record modification, any authenticated session can issue write operations against Onboarding Step records. The affected product is identified by CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, covering all versions prior to the patched release.

RemediationAI

Upgrade Frappe to version 16.17.4 or later, which contains the official fix per the GitHub Security Advisory GHSA-78rj-jch8-42m8 (https://github.com/frappe/frappe/security/advisories/GHSA-78rj-jch8-42m8). For deployments that cannot immediately patch, a compensating control is to restrict access to the Onboarding Step doctype at the Frappe role permission level - administrators can remove Write permissions on the Onboarding Step doctype for all non-System Manager roles via the Role Permissions Manager. This trade-off is that users who legitimately interact with onboarding workflows may lose access, potentially requiring role re-assignment after the patch is applied. No workaround eliminates the root cause; the role-based restriction is a mitigation only.