Auth bypass in Frappe
CVE-2026-47765
Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents wi…
Vulnerability class: Broken Access Control
Affected products
- Frappe — versions < 15.110.0, >= 16.0.0-beta.1, < 16.20.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)