CVE-2026-66003: Frappe Framework Auth Bypass Vulnerability

CVE-2026-66003 Overview

CVE-2026-66003 is an access control bypass in the Frappe full-stack web application framework. The flaw affects versions prior to 15.115.0 and resides in the REST API layer. When a document references another document through a Link field, the framework fails to consistently enforce the linked DocType's own permissions during retrieval. A low-privileged authenticated user can read fields from linked records outside their authorized scope. The issue maps to CWE-863: Incorrect Authorization and is fixed in Frappe 15.115.0.

Critical Impact
Authenticated attackers with minimal privileges can exfiltrate confidential data from linked DocTypes they should not be able to read, breaking multi-tenant and role-based access boundaries.

Affected Products

Frappe Framework versions prior to 15.115.0
Applications built on the Frappe framework that expose the REST API to low-privileged users
Deployments relying on DocType-level permissions for confidentiality of linked records

Discovery Timeline

2026-08-26 - CVE-2026-66003 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-66003

Vulnerability Analysis

Frappe models relationships between records using Link fields, where one document references another document by DocType and name. The REST API returns these references when a client requests a parent document. The framework is expected to check the linked DocType's own permission rules before including linked field values in the response.

The framework does not consistently perform this check. A user authorized to read a parent DocType can therefore read fields belonging to a referenced DocType even when the role-based permission model forbids direct access to that referenced DocType. This breaks the confidentiality assumptions that administrators express through Frappe's role and permission engine.

Root Cause

The root cause is inconsistent authorization enforcement across code paths in the REST API [CWE-863]. Permission checks applied when a DocType is accessed directly are not applied when the same DocType is reached transitively through a Link field. The framework treats the linked value as data attached to the parent record rather than as a separate resource requiring an independent authorization decision.

Attack Vector

An authenticated attacker with any role that grants read access to a parent DocType issues REST API requests for records containing Link fields to sensitive DocTypes. The response includes fields from the linked record. Sensitive DocTypes commonly include user records, customer data, financial documents, and internal configuration. The attack requires only network access to the REST API and low privileges. No user interaction is required.

No verified public exploit or proof-of-concept has been released. See the GitHub Security Advisory GHSA-p25m-7rvg-6fvr for technical details.

Detection Methods for CVE-2026-66003

Indicators of Compromise

REST API requests from low-privileged accounts targeting endpoints such as /api/resource/<DocType> that return fields belonging to Link targets outside the user's normal scope.
Spikes in GET requests against DocTypes containing Link fields to sensitive resources like User, Customer, or Supplier.
Enumeration patterns where a single session iterates through record name values sequentially.

Detection Strategies

Enable Frappe request logging and correlate API response fields against the requesting user's role permissions.
Alert when API responses contain fields from DocTypes for which the caller has no explicit read permission.
Baseline normal REST API usage per role and flag deviations in accessed DocTypes and field volume.

Monitoring Recommendations

Ingest Frappe application and web server logs into a centralized analytics or SIEM platform for role-versus-response validation.
Track authenticated session activity for anomalous read volumes and repeated /api/resource/ calls.
Monitor for privilege reconnaissance behavior such as repeated queries against permission and role endpoints prior to bulk record reads.

How to Mitigate CVE-2026-66003

Immediate Actions Required

Upgrade Frappe to version 15.115.0 or later on all production and non-production instances.
Audit REST API access logs for the past 90 days to identify potential unauthorized reads of linked record fields.
Review and tighten role permissions on DocTypes containing sensitive Link fields.
Rotate credentials and revoke API keys for any account showing anomalous read activity.

Patch Information

The issue is fixed in Frappe 15.115.0. Deploy the upgrade through your standard bench update process and restart the Frappe workers. See the Frappe v15.115.0 release notes and the GitHub Security Advisory GHSA-p25m-7rvg-6fvr for advisory details.

Workarounds

Restrict REST API access at the network layer to trusted IP ranges until the patch is applied.
Disable or restrict low-privileged roles from accessing DocTypes that contain Link fields pointing to sensitive data.
Remove or reduce Link fields on custom DocTypes that reference confidential DocTypes where feasible.
Enforce API key scoping and short session lifetimes to limit exposure from any single compromised account.

bash

# Upgrade Frappe using bench to the fixed version
bench update --patch
bench switch-to-branch version-15 frappe --upgrade
bench setup requirements
bench migrate
bench restart

# Verify the installed version is 15.115.0 or later
bench version | grep frappe