Frappe Framework REST API authorization bypass exposes linked DocType data

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link field, the framework does not consistently enforce the linked DocType's own permissions when the record is retrieved through the REST API, so a low-privileged authenticated user can obtain fields from linked records outside their permitted scope. This issue is fixed in version 15.115.0.

• The Python frappe package is affected in versions < 15.115.0.
• The affected behavior is in REST API handling of data from Linked DocTypes and Link fields.
• The confirmed patched release is v15.115.0.
• The available evidence does not establish the status of parallel release branches or other integrated products outside this scope.

Frappe does not consistently enforce the linked DocType's own permissions when a record is retrieved through the REST API. When one document references another through a Link field, fields from the linked record may be returned even though the user lacks direct permission to access that DocType. The supported preconditions are a low-privileged authenticated account and network access to the REST API; interaction from another user is not required. This is CWE-863: Incorrect Authorization, because the access-control boundary for the requested document is not consistently applied to the referenced document. The available evidence does not identify a specific endpoint, parameter, or payload, and does not establish that every query type or deployment configuration is affected.

The flaw is network-reachable through the REST API and requires the attacker to be authenticated with a low-privileged account. The available evidence indicates that administrative privileges and interaction from another user are not required, and that exploitation has low complexity. An attacker may be able to read fields from Linked DocTypes outside the account's permitted scope when related data is returned with a requested record. The supplied record does not confirm ongoing exploitation or identify a specific campaign. No public exploit is identified in the record, and the checked evidence does not disclose a specific endpoint, parameter, or exploit request sequence.

The primary technical outcome is unauthorized information disclosure: an authenticated user can receive fields from Linked DocTypes that the user's permissions do not allow them to access directly. The flaw breaks authorization enforcement between the requested document and the referenced document, but the evidence does not indicate data modification or an availability impact. Organizational consequences may include a violation of least-privilege controls, access review requirements, and incident assessment obligations depending on the data exposed. The actual data scope depends on the DocTypes, Link fields, and permissions configured in each deployment.

The flaw can expose data from linked records to users who are not authorized to view those records.

• Data: Fields belonging to Linked DocTypes may be disclosed outside the intended authorization scope.
• Access control: The boundary between data an account may read directly and data referenced indirectly can be bypassed.
• Operations and compliance: Organizations may need to review potentially affected access, determine what data could have been viewed, and assess incident-handling obligations if sensitive fields were exposed.
• Limit: The evidence describes unauthorized reading; it does not establish data modification or service disruption.

1. Upgrade the frappe package to v15.115.0, the confirmed patched release in the advisory and affected data.
2. Restart or redeploy Frappe components according to the organization's operational process, then verify the version actually running on every REST API instance.
3. Run authorization regression tests against DocTypes with Link fields to confirm that Linked DocType permissions are enforced when data is read through the REST API.
4. The vendor advisory states that no workaround is available. Do not treat temporary user-permission restrictions as a substitute for the patch unless they have been separately validated in the specific deployment.
5. Review pre-patch access logs for requests from low-privileged accounts that may have returned fields from Linked DocTypes outside their authorized scope. The available record does not provide specific IOCs.

1. Inventory Frappe services and identify deployments that allow authenticated users to access the REST API.
2. Check the installed frappe package version in each environment and compare it with the affected and patched boundaries in affected_summary.
3. Identify DocTypes containing Link fields, especially cases where a user can read the source document but is not authorized to read the corresponding Linked DocType.
4. Review REST API logs as a precaution for low-privileged accounts retrieving records that include fields from Linked DocTypes they would not normally be allowed to access. This is a review signal, not a vendor-confirmed IOC.
5. Run controlled authorization regression tests to verify that Linked DocType permissions are enforced when data is retrieved through the REST API. The absence of matching log entries does not prove that a deployment is safe.