CVE-2026-66002— Frappe: User Enumeration via PDDR
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 是一个全栈 Web 应用框架。在版本 15.115.0 和 16.27.0 之前，frappe/website/doctype/personal_data_download_request/personal_data_download_request.py 文件中的公共请求数据 Web 表单以及 PersonalDataDownloadRequest 类，针对已注册和未注册的邮箱地址会返回可区分的响应结构，包括包含 user_name 字段及其持久化行为。远程攻击者可以通过比较这些响应来枚举已注册用户
Possible ATT&CK Techniques 1 AI
T1589.001 · Credentials
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66002
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe: User Enumeration via PDDR
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
响应差异性信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66002
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66002
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66002 (5)
Vendor Advisories for CVE-2026-66002 (1)
-
🔗 User Enumeration via PDDR · Advisory · frappe/frappe · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-66002 (1)
-
🔗 Release v16.27.0 · frappe/frappe · GitHub x_refsource_MISC
Same Patch Batch · frappe · 2026-08-20 · 5 CVEs total
| CVE-2026-66001 | 8.5 HIGH | Frappe: Improper Authorization in OAuth2 Consent Endpoint |
| CVE-2026-62315 | 7.1 HIGH | Frappe: Mass assignment via set_value |
| CVE-2026-63654 | 6.9 MEDIUM | Frappe: Unauthenticated Workflow approval via confirm_action |
| CVE-2026-53569 | 5.3 MEDIUM | Frappe: Missing authorization in toggle_like and mark_as_seen |
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-63654
Frappe: Unauthenticated Workflow approval via confirm_action -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see -
CVE-2026-66000
Frappe: Unrestricted access to Document Follow APIs
Same vendor: frappe
-
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-63654
Frappe: Unauthenticated Workflow approval via confirm_action -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see -
CVE-2026-65822
ERPNext: SQL Injection in "Inactive Customers" report via un
Same weakness: CWE-204
-
CVE-2026-27462
Combodo iTop: User enumeration via password reset -
CVE-2026-69519
Azure Stack HCI Information Disclosure Vulnerability -
CVE-2026-54739
Lemmy: Login Endpoint User Enumeration via HTTP Response Cod -
CVE-2026-19965
automad Password Reset Endpoint UserController.php requestPa -
CVE-2026-14672
PostgreSQL observable response discrepancy with non-default
V. Comments for CVE-2026-66002
No comments yet