CVE-2026-111388 frappe CVE debrief

Who should care

Defenders responsible for Frappe Framework deployments, security teams, and administrators should assess exposure and prioritize remediation. This includes reviewing authentication methods, restricting IP addresses, and implementing additional logging and monitoring for authentication attempts. The vulnerability affects Frappe Framework versions before 15.120.0 and 16.x before 16.33.0, and has a CVSS score of 5.3 and a CVSS severity of MEDIUM.

Why it matters

CVE-2026-111388 is a medium-severity vulnerability in Frappe Framework that allows attackers with valid authentication credentials to bypass network-based access restrictions. Defenders should prioritize verifying Frappe Framework versions and configurations, reviewing authentication methods, and restricting IP addresses to mitigate this vulnerability.

• Verify authentication method configurations to prevent IP allowlist bypass
• Review and restrict IP addresses for Frappe Framework users
• Implement additional logging and monitoring for authentication attempts

Technical summary

The Frappe Framework does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. This allows attackers with valid credentials to authenticate from IP addresses outside the allowlist. The vulnerability has a CVSS score of 5.3 and a CVSS severity of MEDIUM. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is needed. Defenders should prioritize verifying Frappe Framework versions and configurations, reviewing authentication methods, and restricting IP addresses to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying Frappe Framework versions and configurations, reviewing authentication methods, and restricting IP addresses to mitigate this vulnerability.

Recommended defensive actions

• Verify Frappe Framework versions and configurations
• Review authentication methods and restrict IP addresses
• Implement additional logging and monitoring for authentication attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is needed. The Frappe Framework security advisory and Vulncheck advisory provide further context on the vulnerability. However, the exact scope of affected deployments and specific remediation steps are not provided. Defenders should verify Frappe Framework versions and configurations, review authentication methods, and restrict IP addresses to mitigate this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.