CVE-2026-47422

5.3 mediumEPSS 0.4%

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-07-10
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248

Check your stack JSON