P4Verified

CVE-2024-58390: frappe 0 to before 14.81.4, 15.0.0 to before 15.41.0

CVE-2024-58390. CVSS 3.1 base score 8.8 (GitHub Advisory Database).

Affected technology

frappe · 0 to before 14.81.4, 15.0.0 to before 15.41.0
frappe

Description’s affected range: before 14.81.4 and 15.x before 15.41.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.

Published 13-Oct-2026 01:49 UTC

CWE: CWE-269
CCR priority: 35.2 /100 (P4)
CVSS 3.1: 8.8 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · GitHub Advisory Database
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-13 02:51:46.931182+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-13 01:49:08.152775+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2024-58390.html