Frappe Framework CVE-2026-50026

No special conditions are required for exploitation. The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L/AT:N) confirms remote unauthenticated exploitation against any network-accessible Frappe instance on a vulnerable version without non-default configuration. The description does not specify a feature flag, module, or deployment mode as a prerequisite. Exploitation is limited by: (1) the need to identify the specific unprotected endpoint paths, which are not publicly disclosed in available advisories; (2) impact bounded to the data scope of those specific endpoints (VC:L/VI:L) rather than full application or system compromise; and (3) Frappe deployments that are not Internet-facing reduce exposure to the network-vector attack.

The CVSS 4.0 score of 6.9 (Medium) reflects a straightforward unauthenticated network attack (AV:N, AC:L, AT:N, PR:N, UI:N) offset by bounded impact (VC:L/VI:L/VA:N). EPSS at 0.03% in the 9th percentile aligns with the absence of publicly known exploit code and the absence of a CISA KEV listing, indicating no confirmed active exploitation at time of analysis. The combination of zero authentication requirements and no special conditions makes this conceptually easy to exploit once the affected endpoints are identified; however, the limited impact scope - partial read and write access to specific resources rather than full system compromise - reduces urgency compared to higher-severity missing-auth issues. Real-world risk scales directly with the sensitivity of data managed by the Frappe deployment. ERPNext instances handling financial, HR, or customer data should treat this as a priority patch even at Medium severity.

An unauthenticated remote attacker identifies a publicly accessible Frappe instance running a vulnerable version and enumerates its API endpoints. By sending crafted HTTP requests directly to the affected endpoints - which skip permission validation - the attacker reads or writes resources belonging to other users or privileged contexts without any credential. No public proof-of-concept has been identified, but the missing-authorization pattern is straightforward to exploit once the specific endpoint paths are known.