CVE-2026-44976 MEDIUM

CVE-2026-44976: Frappe: IDOR in update_onboarding_step

Vendor Frappe

Product frappe

Weakness CWE-284

Published June 12, 2026

Last update June 12, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.

Key dates

02Disclosure timeline

June 12, 2026 CVE published

June 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-44976 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Related vulnerabilities

04Related CVE

CVE-2023-1491 Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control CVE-2021-1477 Cisco Firepower Management Center Software Policy Vulnerability CVE-2017-9285 Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface CVE-2025-65097 Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections CVE-2023-41679