CVE-2026-47765 — Frappe: Lack of Permissions in restore/bulk_restore
Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, …
Published: 2026-08-06 · CVSS: 7.1 · CVSS 4.0
Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7