PT-2026-115394 · Unknown · Frappe Framework
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Frappe Framework versions prior to 15.120.0
Frappe Framework versions 16.x prior to 16.33.0
Description
The software fails to enforce the per-user
restrict ip allowlist for non-session authentication methods. This includes API key, OAuth, and header-based authentication. An attacker with valid credentials for these methods can authenticate from IP addresses that are not on the allowlist, bypassing network-based access restrictions.Recommendations
Update to version 15.120.0 or later.
Update to version 16.33.0 or later.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frappe Framework