CVE-2026-66002: Frappe: User Enumeration via PDDR
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and unregistered email addresses, including the username field and persistence behavior. A remote attacker can compare the responses to enumerate registered users. This issue is fixed in versions 15.115.0 and 16.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.115.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.27.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Frappe deployments running a version earlier than 15.115.0 or 16.27.0 are affected if the public request-data web form is reachable.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely by submitting email addresses to the public request-data form and comparing response shapes. No authenticated access is described as necessary.
How can an organization determine whether user enumeration is occurring?
Review requests to the public request-data form for repeated submissions using different email addresses and compare the resulting response patterns and PersonalDataDownloadRequest persistence behavior. Responses that expose a user_name field for registered addresses indicate the distinguishable behavior described.
What is the remediation?
Upgrade Frappe to version 15.115.0 or 16.27.0, which contain the fix.