Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M

CVE-2026-47765Frappe: Lack of Permissions in restore/bulk_restore

High 7.1

In plain English

A high-severity missing authorization in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	< 15.110.0>= 16.0.0-beta.1, < 16.20.0

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf x_refsource_CONFIRM
https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e x_refsource_MISC
https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0 x_refsource_MISC