CVE-2026-47422: Frappe: Unrestricted API access to save_report

Q: What is the severity of CVE-2026-47422?

CVE-2026-47422 has a medium severity level with a CVSS score of 5.3.

Q: How do I fix CVE-2026-47422?

To fix CVE-2026-47422, upgrade to Frappe version 15.107.5 or 16.18.2.

Q: What does CVE-2026-47422 affect?

CVE-2026-47422 affects the Frappe framework and specifically an endpoint in reportview that lacked appropriate permission checks.

Q: When was CVE-2026-47422 published?

CVE-2026-47422 was published on July 10, 2026.

Q: Are older versions of Frappe vulnerable to CVE-2026-47422?

Yes, Frappe versions prior to 15.107.5 and 16.18.2 are vulnerable to CVE-2026-47422.

Published Jul 10, 2026

Updated

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

Affected Software

1 affected component

Frappe frappe<15.107.5, <16.18.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 15.107.5
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 16.18.2

Event History

Jul 10, 2026

CVE Published

via MITRE·09:09 PM

Data Sourced

via MITRE·09:09 PM

DescriptionWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-47422?

CVE-2026-47422 has a medium severity level with a CVSS score of 5.3.

How do I fix CVE-2026-47422?

To fix CVE-2026-47422, upgrade to Frappe version 15.107.5 or 16.18.2.

What does CVE-2026-47422 affect?

CVE-2026-47422 affects the Frappe framework and specifically an endpoint in reportview that lacked appropriate permission checks.

When was CVE-2026-47422 published?