Is there a patch available for CVE-2026-50026?

Yes, a patch is available for CVE-2026-50026. Update the affected software to the latest version immediately.

Frappe Framework CVE-2026-50026

Q: What is the CVSS score of CVE-2026-50026?

CVE-2026-50026 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36458 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 GitHub_M

Authentication Bypass Frappe

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable endpoints require no privileges or user interaction; limited read/write impact per VC:L/VI:L in the provided CVSS 4.0 vector; no scope change or availability impact indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:30 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

AnalysisAI

Missing authorization checks on multiple Frappe framework endpoints allow remote unauthenticated attackers to access and modify resources without permission. All Frappe installations on the 15.x branch prior to 15.107.0 and the 16.x branch prior to 16.17.0 are affected. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% reflects minimal current exploitation activity, though the attack requires no credentials or special preconditions.

Technical ContextAI

Frappe is an open-source Python-based full-stack web application framework that underpins ERPNext and numerous business applications. The root cause is CWE-862 (Missing Authorization): specific API endpoints process incoming requests without enforcing access control checks, meaning the framework's permission layer is entirely bypassed for those routes. The CPE identifier cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* spans all platform variants and versions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the vulnerable endpoints are directly reachable over the network with no prerequisite attack conditions, no required user interaction, and no configuration prerequisites. Impact is constrained to the data scope of those endpoints - low confidentiality and low integrity - with no availability degradation.

RemediationAI

Vendor-released patches are available: operators on the version 15 branch must upgrade to Frappe 15.107.0 or later, and operators on the version 16 branch must upgrade to Frappe 16.17.0 or later. Full patch details are available at https://github.com/frappe/frappe/security/advisories/GHSA-q6m6-759h-46jp. If immediate patching is not possible, apply network-layer controls to restrict access to the Frappe application to trusted IP ranges or authenticated reverse-proxy sessions, preventing unauthenticated external access to the API surface - note this may limit legitimate remote API integrations and should be scoped accordingly. Identify the specific unguarded endpoints via the advisory patch diff and consider temporarily disabling those routes at the web server level as a targeted compensating control.