Description
Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.
Published: 2026-07-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An endpoint in Frappe Framework’s reportview exposed the save_report API without any permission checks. This flaw (CWE‑862) allows an attacker to create or modify reports via direct API calls without authentication or role verification, potentially compromising data integrity.

Affected Systems

The vulnerability applies to the Frappe Framework (frappe:frappe) versions earlier than 15.107.5 in the 15.x branch and earlier than 16.18.2 in the 16.x branch. Updating to the specified patched releases removes the missing authorization check.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate impact, while the EPSS score of less than 1% and absence from CISA KEV suggest exploitation is possible but uncommon. The likely attack vector is an unauthenticated or minimally authenticated HTTP request to the /save_report endpoint; no public exploits have been documented.

Generated by OpenCVE AI on July 29, 2026 at 09:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Frappe to version 15.107.5 or newer in the 15.x line, or to 16.18.2 or newer in the 16.x line.
  • If an immediate upgrade is not possible, block or restrict public access to the /save_report API via network firewall or internal routing until the patch is applied.
  • Confirm that role‑based permissions in the application allow only authorized user roles to invoke the save_report endpoint.

Generated by OpenCVE AI on July 29, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.
Title Frappe: Unrestricted API access to save_report
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-14T14:35:18.141Z

Reserved: 2026-05-19T19:37:43.526Z

Link: CVE-2026-47422

cve-icon Vulnrichment

Updated: 2026-07-14T13:45:54.044Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T10:00:15Z

Weaknesses