CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

• CWE-863

• https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4
• https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9
• https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4

Published

Aug 7, 2026

Last Modified

Aug 8, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66041FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains …7.8
• CVE-2026-6605A security flaw has been discovered in modelscope agentscope…7.3
• CVE-2026-66050NitroShare Desktop through 0.3.4 contains a path traversal v…8.7
• CVE-2026-66051Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-66053Improper Validation of Certificate with Host Mismatch vulner…5.9
• CVE-2026-66058Frappe is a full-stack web application framework. Prior to 1…5.3
• CVE-2026-6606A weakness has been identified in modelscope agentscope up t…7.3
• CVE-2026-66060Home Assistant is open source home automation software focus…7.1
• CVE-2026-66061Home Assistant is open source home automation software focus…7.1
• CVE-2026-66062SvelteKit is a framework for rapidly developing robust, perf…5.3
• CVE-2026-66063goshs is a feature-rich single-binary file server for red te…6.5
• CVE-2026-66064goshs is a feature-rich single-binary file server for red te…5.3