CVE-2026-47422 Overview
CVE-2026-47422 is a missing authorization vulnerability [CWE-862] in the Frappe full-stack web application framework. An endpoint in the reportview module lacked appropriate permission checks. Authenticated users with low privileges can access data through the endpoint without the expected authorization enforcement. The issue affects Frappe versions prior to 15.107.5 and 16.18.2. Maintainers addressed the flaw in releases 15.107.5 and 16.18.2.
Critical Impact
Authenticated attackers can query data through the reportview endpoint without the required permission checks, resulting in limited confidentiality and integrity impact on affected Frappe deployments.
Affected Products
- Frappe framework versions prior to 15.107.5
- Frappe framework versions prior to 16.18.2
Discovery Timeline
- 2026-07-10 - CVE-2026-47422 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-47422
Vulnerability Analysis
Frappe is a Python-based full-stack web application framework that powers ERPNext and related applications. The framework exposes a reportview module used to query and render list views, reports, and filtered record sets. One endpoint in reportview failed to enforce the permission checks that Frappe normally applies to document access.
The result is a Missing Authorization condition classified under [CWE-862]. An attacker authenticated as a low-privileged user can invoke the endpoint and reach data paths that should be gated by role-based permissions. The vector requires network access and low privileges, without user interaction.
Because the flaw sits inside a general-purpose reporting endpoint, exposure depends on which DocTypes are queryable through it. The advisory does not indicate exploitation in the wild, and the EPSS data reflects a low near-term exploitation probability.
Root Cause
The root cause is the absence of an authorization check on a reportview endpoint. Frappe expects each data-access path to validate the caller's DocType-level and record-level permissions before returning results. The affected endpoint bypassed that validation, allowing requests to proceed on the basis of authentication alone.
Attack Vector
Exploitation is performed over the network against the Frappe HTTP interface. The attacker must hold a valid session with at least low-privileged access to the target site. They then send crafted requests to the vulnerable reportview endpoint to retrieve or manipulate data that role-based access control should block. No user interaction is required.
No public proof-of-concept code is referenced in the enriched data. Technical specifics are documented in the GitHub Security Advisory GHSA-w8g7-j846-j248.
Detection Methods for CVE-2026-47422
Indicators of Compromise
- Unexpected HTTP requests to reportview endpoints originating from low-privileged user sessions.
- Access log entries showing repeated reportview calls referencing DocTypes the requesting user does not normally use.
- Anomalous data export or list-query volume tied to a single authenticated account.
Detection Strategies
- Compare reportview request patterns against the roles assigned to the requesting user in Frappe's permission manager.
- Alert when authenticated users query DocTypes outside their assigned modules or role profile.
- Review Frappe application logs for reportview requests that succeeded prior to upgrading to 15.107.5 or 16.18.2.
Monitoring Recommendations
- Forward Frappe web server and application logs to a centralized logging platform for retention and correlation.
- Baseline normal reportview usage per role and flag deviations for investigation.
- Track the installed Frappe version across all sites and alert on hosts running versions below 15.107.5 or 16.18.2.
How to Mitigate CVE-2026-47422
Immediate Actions Required
- Upgrade Frappe to 15.107.5 or 16.18.2 or later on all affected sites.
- Audit account roles and remove unnecessary low-privileged accounts that could be abused to reach the endpoint.
- Review recent reportview access logs for signs of unauthorized data retrieval before patching.
Patch Information
The vulnerability is fixed in Frappe 15.107.5 and 16.18.2. Refer to the GitHub Security Advisory GHSA-w8g7-j846-j248 for the upstream fix details and release notes.
Workarounds
- No official workaround is published; upgrading to a fixed release is the supported remediation.
- Restrict network exposure of Frappe administrative interfaces to trusted networks until the patch is applied.
- Temporarily disable or limit accounts that do not require access to reporting features while planning the upgrade.
# Upgrade Frappe using the bench CLI
bench switch-to-branch version-15 frappe --upgrade
bench update --patch
bench --site all migrate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
