CVE-2026-44976: Frappe Framework Auth Bypass Vulnerability

CVE-2026-44976 Overview

CVE-2026-44976 is an improper access control vulnerability [CWE-284] in the Frappe full-stack web application framework. Prior to version 16.17.4, any authenticated user can modify any field in any Onboarding Step record. The flaw stems from missing authorization checks on write operations against the Onboarding Step doctype. An attacker with low-privilege credentials can tamper with onboarding workflow data used by other users and administrators. The maintainers patched the issue in Frappe 16.17.4.

Critical Impact
Any authenticated Frappe user can modify Onboarding Step records, enabling tampering with onboarding workflows and integrity of guided setup data.

Affected Products

Frappe Framework versions prior to 16.17.4
Applications built on the affected Frappe versions that expose the Onboarding Step doctype
Self-hosted and managed Frappe deployments running vulnerable releases

Discovery Timeline

2026-06-12 - CVE-2026-44976 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44976

Vulnerability Analysis

Frappe exposes a doctype named Onboarding Step that stores fields used to drive guided setup experiences. The vulnerable releases do not enforce role-based or owner-based permission checks when these records are updated. As a result, any authenticated session can issue write requests against Onboarding Step documents and change arbitrary fields.

The vulnerability affects integrity rather than confidentiality or availability. Attackers cannot directly read sensitive data or crash the application through this flaw. They can, however, modify onboarding content presented to other users, including administrators, which may be leveraged to support phishing, workflow disruption, or social engineering against privileged operators.

Root Cause

The root cause is missing authorization enforcement on the Onboarding Step doctype, classified under [CWE-284] Improper Access Control. The doctype's permission rules did not restrict write access to users with the appropriate role, so the framework's default request handlers accepted modifications from any authenticated principal. The fix in version 16.17.4 tightens permissions on the Onboarding Step doctype.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticates to the Frappe instance using any valid account, then sends an update request against the Onboarding Step REST endpoint or via the standard Frappe client API. Because no role check gates the operation, the server commits the modified fields. Refer to the GitHub Security Advisory GHSA-78rj-jch8-42m8 for additional technical context.

Detection Methods for CVE-2026-44976

Indicators of Compromise

Unexpected modifications to Onboarding Step records, particularly changes made by low-privilege user accounts
Audit log entries showing writes to the Onboarding Step doctype originating from accounts that have no business reason to modify onboarding content
Onboarding flows displaying altered titles, descriptions, or action URLs that point to unfamiliar destinations

Detection Strategies

Query the Frappe activity log for DocType = 'Onboarding Step' write events and correlate against the expected administrator accounts
Establish a baseline of legitimate Onboarding Step content and alert on diffs in fields such as title, description, action, and path
Inspect HTTP access logs for POST and PUT requests against /api/resource/Onboarding Step paths from non-administrative sessions

Monitoring Recommendations

Enable Frappe's document change tracking on the Onboarding Step doctype and forward events to a centralized SIEM
Monitor authentication telemetry for low-privilege accounts performing write operations on doctypes outside their normal scope
Track the version string of deployed Frappe instances to identify hosts still running versions older than 16.17.4

How to Mitigate CVE-2026-44976

Immediate Actions Required

Upgrade all Frappe deployments to version 16.17.4 or later as the primary remediation
Audit the Onboarding Step doctype for unauthorized modifications introduced before patching
Restrict network exposure of the Frappe instance to trusted users while patching is in progress

Patch Information

The issue is fixed in Frappe 16.17.4. The patch enforces proper permission checks on the Onboarding Step doctype so only authorized roles can modify these records. Patch details and commit references are published in the Frappe GHSA-78rj-jch8-42m8 advisory.

Workarounds

Manually tighten the role permissions for the Onboarding Step doctype to restrict write access to the System Manager role
Disable or hide onboarding features in deployments where they are not required until the upgrade is applied
Review and reset any Onboarding Step records that may have been tampered with by non-administrative users

bash

# Upgrade Frappe to the patched release
bench update --no-backup
bench --site <site-name> migrate
bench version | grep frappe
# Confirm version is 16.17.4 or higher