CVE-2026-29077

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29077
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/frappe/frappe/security/advisories/GHSA-5h4c-9p23-4c3m Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
History

09 Mar 2026, 19:04

Type Values Removed Values Added
First Time Frappe frappe
Frappe
References () https://github.com/frappe/frappe/security/advisories/GHSA-5h4c-9p23-4c3m - () https://github.com/frappe/frappe/security/advisories/GHSA-5h4c-9p23-4c3m - Vendor Advisory
CPE cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*

09 Mar 2026, 13:36

Type Values Removed Values Added
Summary
  • (es) Frappe es un framework de aplicación web full-stack. Antes de las versiones 15.98.0 y 14.100.0, debido a una falta de validación al compartir documentos, un usuario podía compartir un documento con un permiso que ellos mismos no tenían. Este problema ha sido parcheado en las versiones 15.98.0 y 14.100.0.

05 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 21:16

Updated : 2026-03-09 19:04

NVD link : CVE-2026-29077

Mitre link : CVE-2026-29077

CVE.ORG link : CVE-2026-29077

JSON object : View

Products Affected

frappe

  • frappe
CWE
CWE-284

Improper Access Control

CWE-602

Client-Side Enforcement of Server-Side Security