CVE-2026-39351 is a critical missing authorization flaw (CVSS 9.1) in the Frappe web framework. The advisory says Frappe allowed unrestricted Doctype access through its API. The affected versions are those before 16.14.0 and 15.104.0, which are the fixed releases, so upgrade whichever branch you run.
What's affected
Frappe before 16.14.0 on the 16 branch, and before 15.104.0 on the 15 branch, is affected. The fixed versions are 16.14.0 and 15.104.0.
Frappe underpins apps such as ERPNext, so check any bench that runs on it. The advisory text is short, so read it for details before you plan.
How to check if you're exposed
bench version
bench --site your-site.example list-apps
Compare the frappe version in the output with 16.14.0 and 15.104.0.
What to do now
- Back up sites, then update with
bench updateto a fixed release on your branch. - Confirm the version afterwards with
bench version. - Review API access logs for unexpected reads or writes of Doctype records.
- Restrict network exposure of the site to the users who need it.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-862 (Missing Authorization). The framework exposes records through an API, and the check that decides who may read or change each Doctype was not enforced as it should be. Because no login is required (PR:N), a network reachable site is enough.
The record gives few technical details beyond the advisory title, so rely on the advisory for specifics. It does not flag this CVE as exploited in the wild.
Quick check
Which versions fix it?
16.14.0 on the 16 branch and 15.104.0 on the 15 branch.
Does it need a login?
The CVSS vector says no privileges are required.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
