CVE-2026-66059: Frappe Auth Bypass Vulnerability

CVE-2026-66059 Overview

CVE-2026-66059 is a field-level authorization flaw in the Frappe full-stack web application framework. The vulnerability allows authenticated users to view restricted DocType fields through the document follow changelog. The document follow feature returned change history without applying per-field permission checks, exposing values that should be hidden from lower-privileged users. The issue is classified as an authorization weakness [CWE-863] and affects Frappe versions prior to 16.20.0 and 15.112.0. Fixed releases are 16.23.0 and 15.112.0. Exploitation requires low-privilege authenticated access and no user interaction.

Critical Impact
Authenticated users can read restricted DocType field values by consuming the document follow changelog, bypassing field-level permissions.

Affected Products

Frappe framework versions prior to 16.20.0
Frappe framework versions prior to 15.112.0
Deployments consuming the document follow changelog API

Discovery Timeline

2026-08-07 - CVE-2026-66059 published to NVD
2026-08-08 - Last updated in NVD database

Technical Details for CVE-2026-66059

Vulnerability Analysis

The vulnerability resides in frappe/desk/form/document_follow.py, which builds timeline items describing changes to documents that a user follows. The helper functions get_field_changed, get_row_changed, and get_added_row produced changelog entries from raw version records without evaluating the requesting user's field-level permissions. As a result, DocType fields marked as restricted, permlevel-protected, or otherwise hidden from a user were included verbatim in the emitted timeline output. An attacker with an authenticated Frappe session and access to the document follow feature can read those restricted fields by requesting changelog data for a followed document.

Root Cause

The changelog builders lacked a user parameter and never called into Frappe's field-permission layer. Authorization was enforced at the document level but not at the field level, meeting the classic [CWE-863] pattern of incorrect authorization applied at the wrong granularity.

Attack Vector

Exploitation is network-based and requires a low-privilege authenticated account. The attacker follows a target document, then retrieves changelog data through the standard Frappe desk interface. Restricted field values appear in the returned timeline items without triggering permission errors. No social engineering or user interaction is required.

python

# Security patch: frappe/desk/form/document_follow.py
# Adds the requesting user to changelog builders so field-level
# permission checks are applied before values are emitted.

			time = frappe.utils.format_datetime(v.modified, "hh:mm a")
			timeline_items = []
			if change.changed:
-				timeline_items = get_field_changed(change.changed, time, doctype, doc_name, v)
+				timeline_items = get_field_changed(change.changed, time, doctype, doc_name, v, user)
			if change.row_changed:
-				timeline_items = get_row_changed(change.row_changed, time, doctype, doc_name, v)
+				timeline_items = get_row_changed(change.row_changed, time, doctype, doc_name, v, user)
			if change.added:
-				timeline_items = get_added_row(change.added, time, doctype, doc_name, v)
+				timeline_items = get_added_row(change.added, time, doctype, doc_name, v, user)

			timeline = timeline + timeline_items

Source: Frappe commit 45dfd14

Detection Methods for CVE-2026-66059

Indicators of Compromise

Requests to document follow endpoints (/api/method/frappe.desk.form.document_follow.*) from low-privileged user sessions.
Timeline payloads containing field values that the requesting role should not be able to read.
Users following an unusually broad range of DocTypes shortly before changelog retrieval.

Detection Strategies

Compare responses from document follow APIs against each user's effective field-level permissions and flag mismatches.
Baseline normal document-following behavior per role and alert on outliers who subscribe to sensitive DocTypes.
Review server logs for repeated document_follow calls returning large timelines to non-privileged accounts.

Monitoring Recommendations

Enable Frappe audit logging for DocType access and correlate with authenticated session identifiers.
Forward Frappe application logs to a centralized platform to retain evidence of pre-patch access to restricted fields.
Alert on version banners indicating unpatched Frappe releases (< 16.23.0 or < 15.112.0).

How to Mitigate CVE-2026-66059

Immediate Actions Required

Upgrade Frappe to 16.23.0 or 15.112.0 or later without delay.
Audit user roles and remove unnecessary access to DocTypes containing restricted fields.
Review recent document follow activity for accounts that should not view sensitive fields.

Patch Information

The fix propagates the requesting user into the changelog builders get_field_changed, get_row_changed, and get_added_row, allowing Frappe's field permission layer to filter restricted values. Patch details are available in the Frappe GitHub Security Advisory GHSA-7vpf-q96h-59x4 and the referenced commits 45dfd14 and d6a214d.

Workarounds

Disable the document follow feature for roles that should not access sensitive DocTypes until patching is complete.
Restrict permlevel on sensitive fields and confirm that only trusted roles retain read access.
Place Frappe behind a reverse proxy that rate-limits and logs calls to frappe.desk.form.document_follow endpoints.

bash

# Upgrade Frappe using bench to a fixed release
bench switch-to-branch version-16 frappe --upgrade
bench update --reset
bench --site all migrate

# Verify installed version is >= 16.23.0 or >= 15.112.0
bench version | grep frappe