CVE-2026-50026: Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints

Q: What is the severity of CVE-2026-50026?

The severity of CVE-2026-50026 is medium with a CVSS score of 6.9.

Q: How do I fix CVE-2026-50026?

To fix CVE-2026-50026, upgrade to Frappe versions 15.107.0 or 16.17.0 or later where the issue has been patched.

Q: What are the affected endpoints in CVE-2026-50026?

The affected endpoints in CVE-2026-50026 are 'relink' and 'set_email_password'.

Q: What risks does CVE-2026-50026 pose?

CVE-2026-50026 poses a risk of unauthorized access to resources due to lack of permission checks.

Q: When was CVE-2026-50026 published?

CVE-2026-50026 was published on June 12, 2026.

Published Jun 12, 2026

Updated

Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

Affected Software

1 affected component

pypi/frappe<15.107.0, <16.17.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 15.107.0
Upgrade
Upgrade Frappe to a version that resolves this vulnerability.
Fixed in 16.17.0

Event History

Jun 12, 2026

CVE Published

via MITRE·02:43 PM

Data Sourced

via MITRE·02:43 PM

DescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-50026?

The severity of CVE-2026-50026 is medium with a CVSS score of 6.9.

How do I fix CVE-2026-50026?

To fix CVE-2026-50026, upgrade to Frappe versions 15.107.0 or 16.17.0 or later where the issue has been patched.

What are the affected endpoints in CVE-2026-50026?

The affected endpoints in CVE-2026-50026 are 'relink' and 'set_email_password'.

What risks does CVE-2026-50026 pose?