CVE-2026-47765 frappe CVE debrief

Who should care

Frappe framework administrators and users with access to the restore and bulk_restore endpoints should verify user authorization and document permissions to prevent unauthorized restoration of deleted documents.

Why it matters

CVE-2026-47765 allows authenticated users to restore deleted documents without required authorization in Frappe framework versions prior to 15.110.0 and 16.20.0, requiring verification of user authorization and document permissions.

• Authenticated users with limited permissions could potentially restore deleted documents.
• Requires verification of user authorization and document permissions for the restore and bulk_restore endpoints.
• Update priority for Frappe framework versions prior to 15.110.0 and 16.20.0.

Technical summary

The Frappe framework versions prior to 15.110.0 and 16.20.0 have a vulnerability in the restore and bulk_restore endpoints, allowing authenticated users to restore deleted documents without the required authorization. This issue arises from inadequate document permission checks in the affected endpoints, potentially leading to unauthorized data restoration and integrity issues. To mitigate this vulnerability, it is essential to verify user authorization and document permissions for these endpoints and update the Frappe framework to versions 15.110.0 or 16.20.0, or later.

Defensive priority

Authenticated users with limited permissions could potentially restore deleted documents, requiring verification of user authorization and document permissions.

Recommended defensive actions

• Verify user authorization and document permissions for the restore and bulk_restore endpoints in Frappe framework versions prior to 15.110.0 and 16.20.0.
• Update Frappe framework to versions 15.110.0 or 16.20.0, or later, to apply the appropriate document permission checks.
• Review and restrict access to the restore and bulk_restore endpoints for authenticated users.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Frappe framework versions prior to 15.110.0 and 16.20.0, where the restore and bulk_restore endpoints do not apply appropriate document permission checks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.