p PatchFirst

CVE-2026-111388

CVE-2026-111388 · Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • frappe

    Versions
    • ≥ 16.0.0, < 16.33.0: Affected (semver)
    • 16.33.0: Not affected (semver)

    Update to 16.33.0

  • frappe

    Versions
    • ≥ 0, < 15.120.0: Affected (semver)
    • 15.120.0: Not affected (semver)

    Update to 15.120.0

Original sources

Check your server →