Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111388Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

Medium 5.4

In plain English

A medium-severity improper access control in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 93.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	16.0.0 – before 16.33.0
frappe	frappe	0 – before 15.120.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-h9jq-7pgf-hw8q) vendor-advisory
VulnCheck Advisory: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication third-party-advisory