Live › vulnerability › CVE-2026-111388
Go to dashboardFrappe Framework does not apply a user's restrict_ip allowlist to API key, OAuth and header-based logins, only to session logins. An attacker holding a valid API key, OAuth token or header credential can use it from IP addresses the allowlist was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that use the per-user restrict_ip setting in Frappe or ERPNext to limit where a user can log in from, and that also issue API keys, OAuth tokens or header-based credentials to those users. A site without per-user IP restrictions, or one that only uses session logins, is not exposed by this flaw. The attacker must already hold a valid credential of one of the affected types.
No product ranges from the sources yet.
bench version or the frappe entry in apps.txt/bench version output; affected versions are below 15.120.0 and 16.x below 16.33.0.restrict_ip field.15.120.0 or 16.33.0 or later.restrict_ip set, and block the relevant API routes at the network edge for addresses outside the allowlist.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111388")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.