CVE-2026-66003: Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.115.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged authenticated user can exploit it if they can access the REST API and retrieve documents that contain Link fields pointing to records in DocTypes they are not authorized to read.
What data could be exposed?
Fields from linked records can be disclosed when a document references another document through a Link field and the linked DocType's permissions are not consistently enforced during REST API retrieval.
Are installations running the fixed version affected?
The issue is fixed in Frappe version 15.115.0. The provided information identifies versions prior to 15.115.0 as affected.