ZeroDay Findings
Sign inSign up

Findings

CVE-2026-39351

Frappe is a full-stack web application framework.

Published Apr 7, 2026 · updated Jul 24, 2026 · frappe frappe

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 7, 2026 · NIST NVD

    Detected

    Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

  2. Jul 24, 2026 · NIST NVD

    Updated

    Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

Affected

  • cpe frappe/frappeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-39351

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-39351

    Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

    nvd.nist.gov

References