Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-29077

Frappe: Broken Access Control in DocShare

Description

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe frappe

  • < 15.98.0affected
  • < 14.100.0affected

References