ZeroDay Findings
Sign inSign up

Findings

CVE-2026-29077

Frappe is a full-stack web application framework.

Published Mar 5, 2026 · updated Jun 17, 2026 · frappe frappe

Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 5, 2026 · NIST NVD

    Detected

    Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

  2. Jun 17, 2026 · NIST NVD

    Updated

    Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0.

Affected

  • cpe frappe/frappeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-29077

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-29077

    Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.1

    nvd.nist.gov

References