CVE-2026-39351: Frappe

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

Affected products

• Frappe Frappe: before 15.104.0 (fixed in 15.104.0); from 16.0.0, before 16.14.0 (fixed in 16.14.0)

Published 2026-04-07. Last modified 2026-07-24.