CVE-2026-58503: Frappe: Unauthenticated User Enumeration via reset_password
Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the resetpassword endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.16.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.106.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58503?
CVE-2026-58503 has a medium severity rating of 6.9 on the CVSS scale.
How do I fix CVE-2026-58503?
To fix CVE-2026-58503, upgrade to Frappe versions 16.16.0 or 15.106.0 or later.
What type of vulnerability is CVE-2026-58503?
CVE-2026-58503 is a vulnerability that allows unauthenticated user enumeration via the reset_password endpoint.
Which versions of Frappe are affected by CVE-2026-58503?
Frappe versions prior to 16.16.0 and 15.106.0 are vulnerable to CVE-2026-58503.
What impact does CVE-2026-58503 have on Frappe applications?
CVE-2026-58503 could allow attackers to enumerate users, potentially leading to further account compromise.