CVE-2026-66003

REST API bypass lets low‑privileged users read unauthorized linked DocTypes via API.

• CVSS 7.1
• 863
• Authentication, Authorization, and Session Management
• Remote

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.

CVE

CVE-2026-66003

CWE

863

CVSS base score

7.1

Published

2026-08-26

OWASP

A01 Broken Access Control

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Frappe

Fixed by upgrading

Yes

Solution

Upgrade Frappe to version 15.115.0 or later.

import frappe

def get_document_with_links(doc_type, name, fields):
    """
    Retrieve a document and its linked fields via REST API.
    """
    # Fetch the main document (permissions are checked)
    doc = frappe.get_doc(doc_type, name)

    # Resolve linked fields without checking linked DocType permissions
    for field in fields:
        meta = frappe.get_meta(doc_type)
        df = meta.get_field(field)
        if df.fieldtype == "Link":
            # VULNERABLE: linked DocType permissions not enforced
            linked_doc = frappe.db.get_value(df.options, doc.get(field))
            doc[field] = linked_doc
    return doc

import frappe

def get_document_with_links(doc_type, name, fields):
    """
    Retrieve a document and its linked fields via REST API.
    """
    # Fetch the main document (permissions are checked)
    doc = frappe.get_doc(doc_type, name)

    # Resolve linked fields with proper permission enforcement
    for field in fields:
        meta = frappe.get_meta(doc_type)
        df = meta.get_field(field)
        if df.fieldtype == "Link":
            # FIX: enforce linked DocType permissions using get_doc
            linked_doc = frappe.get_doc(df.options, doc.get(field))
            doc[field] = linked_doc
    return doc

@misc{vaitp:cve202666003,
  title        = {{REST API bypass lets low‑privileged users read unauthorized linked DocTypes via API.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-66003},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-66003/}}
}