CVE-2026-48127: Frappe Auth Bypass Vulnerability

CVE-2026-48127 Overview

CVE-2026-48127 is a missing authorization vulnerability [CWE-862] in the Frappe full-stack web application framework. Users without write access to a target doctype could attach arbitrary files to that doctype through file-handling API endpoints such as add_attachments. The framework failed to enforce write-permission checks on these attachment endpoints. The issue affects Frappe versions prior to 16.20.0 and 15.110.0, and is fixed in those releases.

Critical Impact
Authenticated low-privileged users can attach files to doctypes they do not have write access to, enabling unauthorized data injection and potential misuse of file storage in Frappe-based applications such as ERPNext.

Affected Products

Frappe Framework versions prior to 15.110.0 (v15 branch)
Frappe Framework versions prior to 16.20.0 (v16 branch)
Downstream Frappe-based applications, including ERPNext deployments, running vulnerable framework versions

Discovery Timeline

2026-07-10 - CVE-2026-48127 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-48127

Vulnerability Analysis

The vulnerability resides in Frappe's file-handling API surface. Endpoints such as add_attachments process attachment operations against a target doctype record. These endpoints did not verify that the calling user held write permission on the target doctype before persisting the attached file. As a result, any authenticated user with a session could invoke the endpoint and attach files to records they should not be able to modify.

This is an authorization flaw, not an authentication bypass. The attacker must hold valid credentials, but no elevated role is required. The impact is limited to integrity of attached data — confidentiality and availability are not directly affected.

Root Cause

The root cause is a missing permission check on file-attachment API handlers. Frappe's permission model relies on server-side enforcement per doctype and per operation. In the vulnerable code path, the attachment endpoint validated the file upload flow but did not call the write-permission gate for the target doctype. The fix introduces a allowed_doctypes_for_guest_uploads System Setting and tightens permission checks in the attachment path.

Attack Vector

An authenticated user sends a crafted request to a file-handling endpoint such as add_attachments, specifying a doctype and name (record identifier) they do not have write access to. The server processes the upload and links the file to the target record without verifying write permission.

python

# Patch excerpt: frappe/core/doctype/system_settings/system_settings.py
		allow_login_after_fail: DF.Int
		allow_login_using_mobile_number: DF.Check
		allow_login_using_user_name: DF.Check
+		allowed_doctypes_for_guest_uploads: DF.SmallText | None
		allowed_file_extensions: DF.SmallText | None
		app_name: DF.Data | None
		apply_strict_user_permissions: DF.Check

Source: Frappe commit 4bf27db

The patch adds an explicit allow-list setting (allowed_doctypes_for_guest_uploads) so that unauthenticated or low-privileged upload paths are gated by administrator configuration rather than defaulting open. The corresponding v16 backport is in commit b1c86042 and additional hardening in commit fee1af6d.

Detection Methods for CVE-2026-48127

Indicators of Compromise

Entries in the File doctype where attached_to_doctype and attached_to_name reference records the uploading user (owner field) lacks write permission on.
HTTP POST requests to /api/method/frappe.desk.form.utils.add_comment, /api/method/frappe.client.attach_file, or endpoints resolving to add_attachments from non-privileged sessions.
Unexpected file records attached to sensitive doctypes (e.g., financial or HR records) from user accounts outside the expected access group.

Detection Strategies

Review Frappe access logs and correlate attachment API calls with the caller's role permissions on the target doctype.
Query the tabFile table for records where the owner does not have a role granting write access to attached_to_doctype.
Alert on spikes in add_attachments API calls per user, especially targeting doctypes outside a user's normal workflow.

Monitoring Recommendations

Enable Frappe's audit trail on the File doctype and forward events to a centralized log platform.
Monitor for creation of File records with unusual file_url extensions or oversized payloads.
Track System Settings changes to allowed_doctypes_for_guest_uploads and allowed_file_extensions post-upgrade.

How to Mitigate CVE-2026-48127

Immediate Actions Required

Upgrade Frappe to version 15.110.0 (v15 branch) or 16.20.0 (v16 branch) or later.
Audit existing File doctype records for unauthorized attachments created prior to patching.
Restrict the allowed_doctypes_for_guest_uploads System Setting to the minimum set of doctypes required by your workflow.
Review role permission maps for the File doctype and remove unnecessary write grants.

Patch Information

The fix is delivered in Frappe v15.110.0 and v16.20.0. Technical details are documented in GitHub Security Advisory GHSA-fwrv-4rw4-97fw, with implementation in PR #39407, PR #39550, and PR #39553.

Workarounds

If immediate upgrade is not feasible, restrict access to file-attachment API endpoints at the reverse proxy layer for untrusted user groups.
Disable guest and low-privileged user roles from calling add_attachments by tightening role-based route protection.
Configure allowed_file_extensions in System Settings to block executable and script file types.

bash

# Verify installed Frappe version and upgrade
bench version --format plain | grep frappe
bench update --patch
bench --site all migrate

# Confirm the new System Setting is present after upgrade
bench --site your-site console <<'PY'
import frappe
print(frappe.db.get_single_value("System Settings", "allowed_doctypes_for_guest_uploads"))
PY