Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e
security-advisories@github.com
https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0
security-advisories@github.com
https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf
security-advisories@github.com