EUVD-2026-43100Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint with no complexity; impact is limited to low confidentiality loss (account enumeration only), with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.
AnalysisAI
User enumeration via the reset_password endpoint in Frappe framework exposes valid account usernames to unauthenticated remote attackers across all versions prior to 15.106.0 and 16.16.0. The flaw stems from observable response discrepancies (CWE-203) that allow systematic probing of registered accounts without any credentials. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the zero-barrier network access makes this a realistic reconnaissance primitive for credential stuffing or targeted phishing campaigns against Frappe-based deployments.
Technical ContextAI
Frappe is a Python-based full-stack web application framework that underpins ERPNext and numerous other enterprise applications. The root cause is CWE-203 (Observable Discrepancy): the reset_password endpoint returns distinguishably different responses - differing HTTP status codes, body content, or timing - depending on whether a submitted identifier matches a valid account. This side-channel allows systematic account existence probing. The CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:* covers all versions in both the v15 and v16 release branches prior to the patched releases. The fix was applied via two separate pull requests (PRs #38625 and #38626) targeting both maintained branches, with corresponding commits 1ff64d4a67f9a6d8819ac059dc69f023fb9ea264 and d3becf5672cbb5c7150447161941aeebeeb84ae8.
RemediationAI
Upgrade Frappe to version 16.16.0 (v16 branch) or 15.106.0 (v15 branch), which resolve the user enumeration discrepancy in the reset_password endpoint. The upstream fixes are in GitHub PRs #38625 (https://github.com/frappe/frappe/pull/38625) and #38626 (https://github.com/frappe/frappe/pull/38626), with release artifacts at https://github.com/frappe/frappe/releases/tag/v16.16.0 and https://github.com/frappe/frappe/releases/tag/v15.106.0. As a compensating control prior to patching, administrators may block public access to the /api/method/frappe.core.doctype.user.user.reset_password endpoint at the reverse proxy layer (e.g., an nginx location block returning 403), though this fully disables the self-service password reset feature for end users and requires an alternative reset workflow. A lower-impact alternative is to apply aggressive rate limiting and IP-based throttling on that endpoint to significantly slow enumeration without disabling the feature, accepting a residual risk that slow enumeration remains possible.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reco
In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Inje
In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_requ
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today