{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/frappe/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frappe:frappe_framework:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2024-58390"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Frappe Framework (\u003c 14.81.4, 15.x \u003c 15.41.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","frappe","cve-2024-58390"],"_cs_type":"advisory","_cs_vendors":["Frappe"],"content_html":"\u003cp\u003eFrappe Framework versions prior to 14.81.4 and 15.x prior to 15.41.0 contain a critical vulnerability related to improper privilege management. This flaw allows an authenticated attacker holding the low-privileged 'Website User' role to escalate their account permissions to the 'System Manager' level. The exploitation involves the manipulation of a specific document action within the application. By successfully executing this escalation, an attacker gains administrative control over the Frappe instance, enabling unauthorized access to application data, configuration settings, and potential further system exploitation. Because Frappe is a common back-end framework for ERPNext and other business applications, successful exploitation carries significant risk to organizational integrity and data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full System Manager privileges within the Frappe application. This provides administrative access to all documents, system configurations, and internal business logic managed by the platform. This vulnerability affects any organization utilizing self-hosted or cloud-deployed versions of Frappe Framework 14.x or 15.x within the specified version ranges. Unauthorized access of this magnitude can lead to complete data exfiltration, service manipulation, and long-term persistence within the business environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of Frappe Framework to version 14.81.4 or 15.41.0 immediately to address CVE-2024-58390.\u003c/li\u003e\n\u003cli\u003eReview user access logs for any 'Website User' accounts that have recently modified sensitive system documents or accessed System Manager configuration endpoints.\u003c/li\u003e\n\u003cli\u003eImplement principle of least privilege by auditing all current 'System Manager' accounts and ensuring only authorized administrative personnel retain such access.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-13T00:30:58Z","date_published":"2026-10-13T00:30:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-frappe-privilege-escalation/","summary":"Frappe versions 14.x and 15.x contain a privilege management vulnerability allowing authenticated Website Users to escalate to System Manager privileges via document action manipulation.","title":"Improper Privilege Management in Frappe Framework","url":"https://feed.craftedsignal.io/briefs/2026-10-frappe-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Frappe","version":"https://jsonfeed.org/version/1.1"}