CVE-2026-58503

N/A Unknown
Published: July 10, 2026 Modified: July 10, 2026
View on NVD

Description

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in versions 16.16.0 and 15.106.0.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/frappe/frappe/commit/1ff64d4a67f9a6d8819ac059dc69f023fb9ea264
Source: security-advisories@github.com
https://github.com/frappe/frappe/commit/d3becf5672cbb5c7150447161941aeebeeb84ae8
Source: security-advisories@github.com
https://github.com/frappe/frappe/pull/38625
Source: security-advisories@github.com
https://github.com/frappe/frappe/pull/38626
Source: security-advisories@github.com
https://github.com/frappe/frappe/releases/tag/v15.106.0
Source: security-advisories@github.com
https://github.com/frappe/frappe/releases/tag/v16.16.0
Source: security-advisories@github.com
https://github.com/frappe/frappe/security/advisories/GHSA-3vqc-c545-w7jg
Source: security-advisories@github.com

7 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-203

Related CVEs

CVE-2026-55175 7.5
CVE-2026-44383 7.5
CVE-2026-42952 7.5
CVE-2026-20744 9.8
CVE-2026-15089 N/A