CVE-2026-44206: Frappe: DB Schema Enumeration via Frappe-Authorization-Source
Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.107.2 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.17.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44206?
The severity of CVE-2026-44206 is classified as medium with a CVSS score of 6.9.
How do I fix CVE-2026-44206?
To fix CVE-2026-44206, upgrade to Frappe version 15.107.2 or 16.17.4 or later.
What vulnerability does CVE-2026-44206 address?
CVE-2026-44206 addresses a vulnerability that allows DB Schema Enumeration through an exploitable endpoint.
Is CVE-2026-44206 present in all versions of Frappe?
Yes, CVE-2026-44206 is present in versions prior to 15.107.2 and 16.17.4 of Frappe.
What type of vulnerability is CVE-2026-44206 classified as?
CVE-2026-44206 is classified as an information leakage vulnerability under the CWE classification.