PT-2026-48889 · Frappe · Frappe

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-44206

NVD

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-44206

Affected Products

Frappe

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-44206 · Security Note
• https://github.com/frappe/frappe/security/advisories/GHSA-9c55-cq5r-qj5x · Note