Frappe Framework EUVD-2026-66704

Exploitation requires a valid authenticated account with at least low-privileged access to the Frappe instance (confirmed by PR:L in the CVSS 4.0 vector). The attacker must be able to identify a parent DocType record they have read access to that contains a Link field pointing to a DocType for which their role lacks permission - a condition common in any multi-role Frappe deployment. No special configuration, non-default settings, or elevated privileges beyond basic authentication are required. Exploitation is read-only: no write, create, or delete capability is exposed. The bypass is specific to the REST API document retrieval path; the security advisory does not confirm whether other access paths (e.g., the Frappe web form UI) are equally affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 7.1, capturing a network-accessible, low-complexity, authenticated read-only confidentiality bypass. No EPSS score was included in the intelligence data, so exploitation probability cannot be quantified from that signal. This CVE is not present in the CISA KEV catalog and no POC code has been identified, indicating no confirmed active exploitation at time of analysis. The practical risk is highest in multi-tenant or multi-role Frappe/ERPNext deployments - common in SME ERP contexts - where role-based data segregation is a security requirement. The PR:L constraint limits exposure to credentialed users, but in shared or SaaS Frappe instances, any low-privileged account becomes a viable attacker. Impact is strictly limited to confidentiality; integrity and availability are unaffected per both the CVSS vector and description.

An authenticated low-privileged user - for example, a sales representative with access only to Sales Order documents - sends a crafted REST API GET request to retrieve a Sales Order record that contains a Link field referencing a restricted DocType such as Customer financial details or Employee payroll records. The framework resolves the linked fields without re-checking the requester's permissions on the target DocType and returns the sensitive data in the API response. No public exploit code has been identified, but the technique is straightforward for any user familiar with Frappe's documented REST API structure.