Is there a patch available for CVE-2026-47422?

Yes, a patch is available for CVE-2026-47422. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-47422

Q: What is the CVSS score of CVE-2026-47422?

CVE-2026-47422 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43099 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 GitHub_M

Authentication Bypass Frappe

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible endpoint requires low-privilege authentication; limited read/write impact on report data; no availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 22:13 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

AnalysisAI

Missing authorization on the reportview endpoint in Frappe framework permits authenticated low-privileged users to access or manipulate report data beyond their permitted scope. Versions prior to 15.107.5 (v15 branch) and 16.18.2 (v16 branch) are affected, confirmed via GitHub Security Advisory GHSA-w8g7-j846-j248. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 PR:L metric confirms exploitation is bounded by requiring a valid authenticated session.

Technical ContextAI

Frappe is a Python/JavaScript full-stack web application framework that underpins ERPNext and several other applications. Its 'reportview' module provides an API endpoint used to build and serve list and report views, handling data queries across the framework's document model. CWE-862 (Missing Authorization) indicates the endpoint accepted and processed requests without verifying that the caller held the necessary document-level or role-based permissions for the requested report resource. The CVSS 4.0 vector (AV:N/PR:L) confirms the endpoint is reachable over the network by any authenticated low-privileged user. The affected CPE is cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, spanning all versions on both the v15 and v16 release lines prior to the respective fixes.

RemediationAI

Upgrade Frappe to version 15.107.5 or later on the v15 line, or to 16.18.2 or later on the v16 line, as confirmed by the vendor security advisory at https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248. If an immediate upgrade is not possible, restrict access to the reportview endpoint at the network or application layer - for example, by limiting API access to trusted internal networks or authenticated sessions with verified role assignments. Be aware that blocking the endpoint broadly will disable report and list view functionality for all users. As a secondary control, audit user roles and permissions within Frappe to ensure low-privileged accounts are minimally scoped, reducing the blast radius of the authorization bypass until patching is complete.