Medium · 5.3 CVE-2026-66059 EUVD-2026-54500

Frappe: Field-level permission bypass via Document Follow

Published Aug 7, 2026 · Updated Aug 8, 2026 · Assigned by GitHub_M

Vendor: Frappe Technologies Product: frappe

Description

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Affected products

Vendor	Product	Affected	Fixed
frappe	frappe	>= 16.0.0-beta.1, < 16.20.0, < 15.112.0	—

References

https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4
https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4
https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9