Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44206: Frappe lets attackers view database structure

CVE-2026-44206 · published 4 months ago

Summary

Older releases of the Frappe web framework expose an endpoint that reveals the layout of the underlying database. This information can aid attackers in planning further attacks. Upgrade to version 15.107.2 or later, or 16.17.4 or later, to close the exposure.

Original advisory text

Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4.

References

https://github.com/frappe/frappe/security/advisories/GHSA-9c55-cq5r-qj5x Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44206... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44206 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published12 Jun 2026

Updated31 Oct 2026

First seen12 Jun 2026

Sources

CVE-2026-44206 · NVD

CVE-2026-44206 · OSV

GHSA-9c55-cq5r-qj5x · GHSA

Track software like this

Free during beta