CVE-2026-47422 — Frappe: Unrestricted API access to save_report

CVE-2026-47422

Frappe: Unrestricted API access to save_report PUBLISHED

Description (CNA)

Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has since been fixed. This vulnerability is fixed in 15.107.5 and 16.18.2.

Affected (CNA)

Vendor / product	Versions
frappe / frappe	affected < 15.107.5; affected >= 16.0.0-beta.1, < 6.18.2

CWE

CWE-862

References

https://github.com/frappe/frappe/security/advisories/GHSA-w8g7-j846-j248

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.