CVE-2026-47422: Frappe Framework reportview Unrestricted API Access

Vulnerability Overview Vulnerability Name: Unrestricted API access to an API in reportview CVE ID: CVE-2026-47422 Severity: Moderate Publication Date: 3 weeks ago Publisher: AarDG10 Impact Scope Affected Versions: - v16.18.2 - > v15.107.5 Remediation Patch: The issue has been fixed; updating to the latest version of the Frappe Framework resolves this problem. Workaround: No workaround is available; it is recommended to update to the latest version of the Frappe Framework. Additional Information Description: An endpoint in lacked proper permission checks; this issue has been fixed. Credits: - Reporter: NSYS - Fix Developer: AarDG10 Links GitHub Repository: frappe/frappe Security Quality: Security and quality Footer Information Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Navigation Bar Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign in: Sign in Sign up: Sign up Notifications Notifications: Notifications Forks: 5.1k Stars: 10.4k Page Content Code: Code Issues: 2.2k Pull requests: 113 Actions: Actions Projects: Projects Wiki: Wiki Security and quality: 64 Insights: Insights Breadcrumbs frappe / Security / Advisories / GHSA-wdg7-j846-j248 Vulnerability Details Package: frappe (pip) Affected versions: - v16.18.2 - > v15.107.5 Description Impact: An endpoint in lacked proper permission checks; this issue has been fixed. Patches: The issue has been fixed; updating to the latest version of the Frappe Framework resolves this problem. Workarounds: No workaround is available; it is recommended to update to the latest version of the Frappe Framework. Credits Reporter: NSYS Remediation developer: AarDG10 Page Footer Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Navigation Bar Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign in: Sign in Sign up: Sign up Notifications Notifications: Notifications Forks: 5.1k Stars: 10.4k Page Content Code: Code Issues: 2.2k Pull requests: 113 Actions: Actions Projects: Projects Wiki: Wiki Security and quality: 64 Insights: Insights Breadcrumbs frappe / Security / Advisories / GHSA-wdg7-j846-j248 Vulnerability Details Package: frappe (pip) Affected versions: - v16.18.2 - > v15.107.5 Description Impact: An endpoint in lacked proper permission checks; this issue has been fixed. Patches: The issue has been fixed; updating to the latest version of the Frappe Framework resolves this problem. Workarounds: No workaround is available; it is recommended to update to the latest version of the Frappe Framework. Credits Reporter: NSYS Remediation developer: AarDG10 Page Footer Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Navigation Bar Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign in: Sign in Sign up: Sign up Notifications Notifications: Notifications Forks: 5.1k Stars: 10.4k Page Content Code: Code Issues: 2.2k Pull requests: 113 Actions: Actions Projects: Projects Wiki: Wiki Security and quality: 64 Insights: Insights Breadcrumbs frappe / Security / Advisories / GHSA-wdg7-j846-j248 Vulnerability Details Package: frappe (pip) Affected versions: - v16.18.2 - > v15.107.5 Description Impact: An endpoint in lacked proper permission checks; this issue has been fixed. Patches: The issue has been fixed; updating to the latest version of the Frappe Framework resolves this problem. Workarounds: No workaround is available; it is recommended to update to the latest version of the Frappe Framework. Credits Reporter: NSYS Remediation developer: AarDG10 Page Footer Copyright: © 2026 GitHub, Inc. Links: Terms, Privacy, Security, Status, Community, Docs, Contact, Manage cookies, Do not share my personal information Navigation Bar Platform: Platform Solutions: Solutions Resources: Resources Open Source: Open Source Enterprise: Enterprise Pricing: Pricing User Actions Sign in: Sign in Sign up: Sign up Notifications Notifications: Notifications Forks: 5.1k Stars: 10.4k Page Content Code: Code Issues: 2.2k Pull requests: 113 Actions: Actions Projects: Projects Wiki: Wiki Security and quality: 64 Insights: Insights Breadcrumbs frappe / Security / Advisories / GHSA-wdg7-j846-j248 Vulnerability Details Package: frappe (pip) Affected versions: - v16.18.2 - > v15.107.5 Description Impact: An endpoint in lacked proper permission checks; this issue has been fixed. Patches: The issue has been fixed; updating to the latest version of the Frappe Framework resolves this problem. Workarounds: No workaround is available; it is recommended

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-47422: Frappe Framework reportview Unrestricted API Access

More from this source