PT-2026-68734 · Frappe · Frappe

CVE-2026-47765

·

Published

2026-08-06

·

Updated

2026-08-07

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.110.0 Frappe versions prior to 16.20.0
Description An issue exists where the 'restore' and 'bulk restore' endpoints fail to apply proper document permission checks. This allows an authenticated user to restore deleted documents without the necessary authorization.
Recommendations Update to version 15.110.0 or newer. Update to version 16.20.0 or newer.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47765
GHSA-CJJX-3V2X-37MF

Affected Products

Frappe