{"id":"CVE-2026-124443","kind":"vulnerability","aliases":["CVE-2026-124443"],"related":[],"title":"Frappe: File list queries expose metadata of private files","description":"Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.","summary":"Frappe Framework fails to restrict private file records in File list and report queries. An authenticated user can see metadata of private files they are not allowed to open.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","package","self-hosted"],"not_affected_if":["fixed-version","no-user-accounts"],"how_to_check":"- Check the Frappe version with `bench version` or the `frappe` entry in your app's dependencies\n- Look for installations of Frappe before `15.121.1` or 16.x before `16.35.0`","fix":"- Frappe `15.121.1` or later on the 15.x line\n- Frappe `16.35.0` or later on the 16.x line","status":"open","published_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:51:01+00:00","updated_at":"2026-11-08T14:51:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:51:01Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe `15.121.1` or later on the 15.x line\n- Frappe `16.35.0` or later on the 16.x line","reach":"internet","title":"Frappe: File list queries expose metadata of private files","impact":"low","summary":"Frappe Framework fails to restrict private file records in File list and report queries. An authenticated user can see metadata of private files they are not allowed to open.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","erpnext","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read metadata of private files they cannot open","analyst_note":"","how_to_check":"- Check the Frappe version with `bench version` or the `frappe` entry in your app's dependencies\n- Look for installations of Frappe before `15.121.1` or 16.x before `16.35.0`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-user-accounts"],"who_is_affected":"Sites running Frappe Framework (including ERPNext and other Frappe apps) where users have accounts and private files exist. An attacker needs a valid login; only file metadata is exposed, not file contents as far as the sources state. Installations on a fixed version or without user accounts can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4594,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124443':12A,15A '-2026':11A,14A '15.121.1':54C '16':56C '16.35.0':59C 'access':63C,102C 'allow':48B 'authent':37B,82C 'author':80C 'broken':62C 'contain':60C 'control':64C 'cve':10A,13A 'erpnext':16B 'expos':5A 'fail':24B,73C 'file':2A,9A,28B,31B,44B,67C,77C,86C,96C 'framework':23B,52C 'frapp':1A,17B,22B,51C 'host':21B 'list':3A,32B,68C,87C 'metadata':6A,41B,93C 'obtain':92C 'open':50B 'packag':18B 'permit':100C 'privat':8A,27B,43B,76C,95C 'queri':4A,35B,71C,85C 'record':29B,78C 'report':34B,70C,89C 'restrict':26B,75C 'see':40B 'self':20B 'self-host':19B 'user':38B,81C,83C 'view':90C 'vulner':65C 'x':57C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe Framework (including ERPNext and other Frappe apps) where users have accounts and private files exist. An attacker needs a valid login; only file metadata is exposed, not file contents as far as the sources state. Installations on a fixed version or without user accounts can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappe","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124443':12A,15A '-2026':11A,14A 'cve':10A,13A 'expos':5A 'file':2A,9A 'frapp':1A 'list':3A 'metadata':6A 'privat':8A 'queri':4A","search_b":"'allow':48B 'authent':37B 'erpnext':16B 'fail':24B 'file':28B,31B,44B 'framework':23B 'frapp':17B,22B 'host':21B 'list':32B 'metadata':41B 'open':50B 'packag':18B 'privat':27B,43B 'queri':35B 'record':29B 'report':34B 'restrict':26B 'see':40B 'self':20B 'self-host':19B 'user':38B","search_c":"'15.121.1':54C '16':56C '16.35.0':59C 'access':63C,102C 'authent':82C 'author':80C 'broken':62C 'contain':60C 'control':64C 'fail':73C 'file':67C,77C,86C,96C 'framework':52C 'frapp':51C 'list':68C,87C 'metadata':93C 'obtain':92C 'permit':100C 'privat':76C,95C 'queri':71C,85C 'record':78C 'report':70C,89C 'restrict':75C 'user':81C,83C 'view':90C 'vulner':65C 'x':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T11:46:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124443","severity":null,"published_at":"2026-11-08T14:18:11+00:00","modified_at":"2026-11-08T14:18:11+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102070,"url":"https://github.com/frappe/frappe/security/advisories/GHSA-7cxg-q8x5-rpjh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T11:46:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102071,"url":"https://www.vulncheck.com/advisories/frappe-before-16.35.0-broken-access-control-in-file-list-report-queries","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}