Frappe: Broken Access Control on Private Files_CVE-2026-47182

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.

Basic Information

ID CVE-2026-47182

Source GitHub_M

Published Jun 12, 2026 at 14:39

Affected Product

Vendor frappe

Product frappe

Version < 16.17.4

Affected Versions frappe frappe < 16.17.4

CWE Classification

CWE-284

References

github.com /frappe/frappe/security/advisories/GHSA-gvg7-4p32-j648

{
    "lastseen": "",
    "description": "Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user can access private files by guessing the file path. This issue has been patched in version 16.17.4.",
    "published": "2026-06-12T14:39:57.995Z",
    "modified": "2026-06-12T14:39:57.995Z",
    "type": "cve",
    "title": "Frappe: Broken Access Control on Private Files",
    "source": "GitHub_M",
    "references": "https://github.com/frappe/frappe/security/advisories/GHSA-gvg7-4p32-j648",
    "id": "CVE-2026-47182",
    "bulletinFamily": "",
    "cwe": [
        "CWE-284"
    ],
    "cvelist": null,
    "sourceData": "frappe frappe < 16.17.4",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "frappe",
    "version": "< 16.17.4",
    "vendor": "frappe",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}