Dashboard / CVE-2026-124443

CVE-2026-124443

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
frappe frappe 16.0.0 < 16.35.0
frappe frappe 0 < 15.121.1
frappe frappe 16.0.0 < 16.35.0
frappe frappe 0 < 15.121.1

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.22%
Raw Score 0.002230
Percentile 13.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00223
2026-11-12
0.00223
2026-11-10
0.00223
2026-11-09
0.00223

Intelligence Sources

mitre ref →
nvd ref →

External Links