CVE-2026-124443: Frappe before 16.35.0 Broken Access Control in File List/Report Queries

Published Nov 8, 2026

Updated

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe Framework to a version that resolves this vulnerability.
Fixed in 15.121.1
Upgrade
Upgrade Frappe Framework to a version that resolves this vulnerability.
Fixed in 16.35.0

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe Framework versions before 15.121.1 are affected, as are 16.x versions before 16.35.0. The issue is in File list and report queries.

What does an attacker need to exploit this issue?

An attacker needs an authenticated user account. No user interaction is required, and the vulnerability can be exploited over the network with low attack complexity.

What information can be exposed?

Affected queries can disclose metadata for private files to users who are not authorized to access those files. The provided data does not indicate that the private file contents themselves can be retrieved through this issue.

CVE-2026-124443: Frappe before 16.35.0 Broken Access Control in File List/Report Queries

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information can be exposed?