CVE-2026-111388— Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Frappe Framework 15.120.0 之前版本以及 16.x 系列中 16.33.0 之前版本中，系统未对非会话认证方法（包括 API 密钥、OAuth 和基于头部的认证方式）强制执行基于每用户的 restrict_ip 白名单限制。攻击者若持有此类有效凭证，可从白名单之外的 IP 地址进行认证，从而绕过已配置的网络访问限制，导致安全防护失效。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111388
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111388
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111388
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111388 (2)
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter -
CVE-2026-109600
Frappe before 16.31.0 Improper Access Control in Document Fo
Same vendor: frappe
-
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing -
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input
Same weakness: CWE-284
-
CVE-2026-61610
Lychee: unauthenticated photo starring reveals existence of -
CVE-2026-9703
Viewer role can create, modify and delete Loki alerting rule -
CVE-2026-103988
FileRise renameFolder omits destination-parent authorization -
CVE-2026-55387
InvoiceShelf bulk deletion lacks company scoping -
CVE-2026-55384
InvoiceShelf trusts client-supplied document totals
V. Comments for CVE-2026-111388
No comments yet