CVE Feed

    Dashboard / CVE / CVE-2026-111388

    CVE-2026-111388

    Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

    Published:Oct 16, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00174
    CVSS Score:5.4

    Affected Products

    Vendor
    Frappe
    Product
    Frappe

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-119145 (CVSS 9.4) — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-up…
    CVE-2026-119144 (CVSS 8.7) — Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerabili…
    CVE-2026-114664 (CVSS 7.1) — Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.…
    CVE-2026-55823 (CVSS 8.7) — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo…
    CVE-2026-66057 (CVSS 5.1) — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an …
    CVE-2026-109603 (CVSS 4.8) — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-…
    CVE-2026-109602 (CVSS 5.1) — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa…
    CVE-2026-109601 (CVSS 7.1) — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the …
    CVE-2026-109600 (CVSS 6.9) — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef…
    CVE-2026-109599 (CVSS 5.3) — Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High