---
id: "CVE-2026-124443"
page: "https://infrastack.ai/live/CVE-2026-124443"
kind: "vulnerability"
aliases: ["CVE-2026-124443"]
title: "Frappe: File list queries expose metadata of private files"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-user-accounts"]
published_at: "2026-11-08T14:18:11+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:51:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124443", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# Frappe: File list queries expose metadata of private files

Link for people: https://infrastack.ai/live/CVE-2026-124443 (this .md is for agents)

Frappe Framework fails to restrict private file records in File list and report queries. An authenticated user can see metadata of private files they are not allowed to open.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Frappe version with `bench version` or the `frappe` entry in your app's dependencies
- Look for installations of Frappe before `15.121.1` or 16.x before `16.35.0`

## Fix

- Frappe `15.121.1` or later on the 15.x line
- Frappe `16.35.0` or later on the 16.x line

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124443

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/frappe/security/advisories/GHSA-7cxg-q8x5-rpjh
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-before-16.35.0-broken-access-control-in-file-list-report-queries

## From the sources

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_