Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Frappe Frappe
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
|
16.0.0
|
16.33.0
|
|
Frappe Frappe
cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*
|
— |
15.120.0
|
References 2
https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q
GitHub Security Advisory (GHSA-h9jq-7pgf-hw8q)
https://www.vulncheck.com/advisories/frappe-before-16.33.0-restrict-ip-allowlis…
VulnCheck Advisory: Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication