{"id":"CVE-2024-58390","published":"2026-10-12T23:17:18.140","lastModified":"2026-10-13T17:17:13.740","description":"Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-gjqf-v2f6-962h","tags":[]},{"url":"https://www.vulncheck.com/advisories/frappe-before-15.41.0-privilege-escalation-via-document-action","tags":[]}],"exploitRefs":[{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-gjqf-v2f6-962h","tags":[]}],"hasPoc":true,"ai":{"summary":"A privilege escalation vulnerability in Frappe allows Website Users to gain full System Manager administrative access through a specific document action. This means attackers with basic website user accounts can escalate their privileges to gain complete control over the application.","exploitability":"The exploit is relatively straightforward for authenticated attackers who already have a Website User account, requiring only a specific document action combined with additional steps to achieve System Manager privileges.","blast_radius":"If exploited, this vulnerability could allow attackers to fully compromise Frappe applications by gaining administrative access, potentially leading to data breaches, unauthorized modifications, and complete system control.","remediation":"Upgrade to Frappe 14.81.4 or 15.41.0 to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","frappe","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:10.157Z"}}