Is there a patch available for EUVD-2026-36491?

Yes, a patch is available for EUVD-2026-36491. Update the affected software to the latest version immediately.

Frappe Framework EUVD-2026-36491

Q: What is the CVSS score of EUVD-2026-36491?

EUVD-2026-36491 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-44975 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 GitHub_M

Authentication Bypass Frappe

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires only a low-privileged authenticated account (PR:L); impact is limited to integrity modification of onboarding state with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:29 vuln.today

DescriptionCVE.org

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4.

AnalysisAI

Missing authorization in Frappe allows any authenticated low-privileged user to invoke the onboarding reset function and wipe onboarding state for all users system-wide, affecting all releases before 15.107.2 and 16.17.4. The CWE-862 root cause indicates the reset endpoint performs no role or privilege check before executing a privileged, system-wide operation. No public exploit code exists and EPSS sits at 0.02% (5th percentile), placing real-world exploitation risk at the lower end despite the disruptive potential of forcing every user through onboarding flows on next login.

Technical ContextAI

Frappe is an open-source Python/JavaScript full-stack web framework that underpins applications such as ERPNext. Per CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*, the flaw spans all versions on the v15 and v16 branches prior to the patched releases. CWE-862 (Missing Authorization) identifies the root cause: the server-side handler responsible for resetting user onboarding state fails to enforce access controls, meaning any session token obtained via normal login is sufficient to trigger a privileged administrative action. Onboarding state in Frappe tracks completion of setup wizards and welcome flows; resetting it globally modifies persistent user records without the knowledge or consent of affected users or administrators.

RemediationAI

Upgrade Frappe to version 15.107.2 (v15 branch) or 16.17.4 (v16 branch), as confirmed by the vendor in GitHub Security Advisory GHSA-9cxj-48g3-jx22 at https://github.com/frappe/frappe/security/advisories/GHSA-9cxj-48g3-jx22. If an immediate upgrade is not feasible, a compensating control is to block access to the specific onboarding reset route at the reverse proxy layer (e.g., nginx or Apache) for all non-administrative roles; note that this will also prevent legitimate administrators from using the feature until the block is removed. Additionally, restricting Frappe application access to trusted internal networks or requiring VPN reduces exposure by limiting the pool of authenticated users who could trigger the flaw.