CVE-2024-58390: Frappe before 15.41.0 Privilege Escalation via Document Action

Q: Which deployments are affected?

Frappe versions before 14.81.4 are affected, as are 15.x versions before 15.41.0. The issue concerns privilege handling within the Frappe application.

Q: What access does an attacker need to exploit this issue?

An attacker must already be authenticated with the Website User role. No user interaction is required, and the attacker can use the vulnerable document action with additional steps to seek System Manager privileges.

Q: Are unauthenticated attackers able to exploit this vulnerability?

The provided information identifies Website User authentication as a prerequisite. It does not indicate that unauthenticated exploitation is possible.

Q: What privilege can an attacker obtain?

A successful attacker can escalate from Website User to System Manager, which is an administrative privilege level in Frappe. The listed impact includes high confidentiality, integrity, and availability impact.

Published Oct 12, 2026

Updated

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

Affected Software

1 affected component

Frappe frappe<14.81.4, >=15.0.0<15.41.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe versions before 14.81.4 are affected, as are 15.x versions before 15.41.0. The issue concerns privilege handling within the Frappe application.

What access does an attacker need to exploit this issue?

An attacker must already be authenticated with the Website User role. No user interaction is required, and the attacker can use the vulnerable document action with additional steps to seek System Manager privileges.

Are unauthenticated attackers able to exploit this vulnerability?

The provided information identifies Website User authentication as a prerequisite. It does not indicate that unauthenticated exploitation is possible.

What privilege can an attacker obtain?

A successful attacker can escalate from Website User to System Manager, which is an administrative privilege level in Frappe. The listed impact includes high confidentiality, integrity, and availability impact.

CVE-2024-58390: Frappe before 15.41.0 Privilege Escalation via Document Action

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

Are unauthenticated attackers able to exploit this vulnerability?

What privilege can an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

Are unauthenticated attackers able to exploit this vulnerability?

What privilege can an attacker obtain?