CVE-2026-111388: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 15.120.0 - Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 16.33.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Frappe Framework versions before 15.120.0, and 16.x versions before 16.33.0, are affected if they rely on the per-user restrict_ip allowlist to limit access.
What does an attacker need to bypass the IP allowlist?
The attacker needs valid credentials usable through a non-session authentication method, such as an API key, OAuth authentication, or header-based authentication. No user interaction is required.
Are users restricted to session-based authentication affected?
The described bypass applies to non-session authentication methods. The provided information does not identify a bypass for session authentication.
How can I determine whether an account may be exposed?
Review whether the account has a restrict_ip allowlist configured and whether it can authenticate with an API key, OAuth, or header-based authentication. Such authentication may succeed from IP addresses not included in that account's allowlist on affected versions.