Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-111388

Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe frappe

Default version status: unaffected

  • 16.0.0 to < 16.33.0affected
  • 16.33.0unaffected
pkg:pypi/frappe

frappe frappe

Default version status: unaffected

  • 0 to < 15.120.0affected
  • 15.120.0unaffected
pkg:pypi/frappe

References