Is there a patch available for CVE-2026-48127?

Yes, a patch is available for CVE-2026-48127. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-48127

Q: What is the CVSS score of CVE-2026-48127?

CVE-2026-48127 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43104 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 GitHub_M

Authentication Bypass Frappe

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible API requires a low-privilege authenticated session (PR:L); scope unchanged, integrity impact limited to unauthorized file attachment, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 22:13 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

AnalysisAI

Unauthorized file attachment in Frappe, a Python/JavaScript full-stack web framework, allows any authenticated low-privilege user to attach files to arbitrary doctypes through file-handling API endpoints such as add_attachments, bypassing per-document write permission enforcement. Affected are all Frappe v15 releases prior to 15.110.0 and all v16 releases prior to 16.20.0. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make exploitation straightforward for any valid account holder on a multi-tenant instance.

Technical ContextAI

Frappe is a metadata-driven, open-source full-stack web framework underpinning business applications such as ERPNext. Its core abstraction is the 'DocType' system, where each document type carries its own permission model (read, write, create, delete). CWE-862 (Missing Authorization) is the root cause: the file attachment API endpoints - including add_attachments - perform authentication checks to confirm the caller has a valid session but do not subsequently verify that the caller holds write-level permission on the target DocType record before persisting the attachment. The affected software is identified by CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, covering the entire Frappe package across all platforms prior to the patched versions.

RemediationAI

Upgrade Frappe to version 16.20.0 or later on the v16 branch, or to version 15.110.0 or later on the v15 branch; these are vendor-confirmed patched releases per https://github.com/frappe/frappe/releases/tag/v16.20.0 and https://github.com/frappe/frappe/releases/tag/v15.110.0. The upstream fixes were delivered via pull requests #39407, #39550, and #39553 (https://github.com/frappe/frappe/pull/39407, /39550, /39553) and associated commits. If patching cannot be applied immediately, restrict network access to the file-attachment API endpoints (add_attachments and related file upload routes) for non-privileged users at the reverse proxy or WAF layer - note this will disable legitimate file attachment functionality for restricted users as a side effect. Do not rely on application-level role configuration alone as a compensating control, since the authorization check at the API layer is the gap being exploited.