Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124443Frappe before 16.35.0 Broken Access Control in File List/Report Queries
- CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests
- CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
- CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities
- CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc
- CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
- CVE-2026-61806Frappe LMS allows unpublished certificate access
- CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgery
- CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount
- CVE-2026-39375Frappe LMS has Stored XSS in Course Meta
- CVE-2026-119145Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
- CVE-2026-119144Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
- CVE-2026-116492Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
- CVE-2026-115720Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
- CVE-2026-115717Frappe Builder before 1.36.1 SSRF via convert_to_webp
- CVE-2026-115718Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
- CVE-2026-114664Frappe before 16.33.0 Blind SQL Injection via get_events
- CVE-2026-111939Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
- CVE-2026-111938Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
- CVE-2026-111937Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
- CVE-2026-64862Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
- CVE-2026-55796Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
- CVE-2026-108373ERPNext: Unauthorised access to financial data due to missing validation
- CVE-2026-108374ERPNext: Unauthorised status modification due to missing validation
- CVE-2026-111389Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
- CVE-2026-111388Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
- CVE-2026-55823Frappe: Possibility of SQL injection in reportview
- CVE-2026-66057Frappe: Open Redirect via Unsanitized OAuth State Param.
- CVE-2026-109675Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
- CVE-2026-109674Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation