{"schema":"threatline.record/2","record":{"id":"GHSA-h9jq-7pgf-hw8q","aliases":["GHSA-h9jq-7pgf-hw8q"],"summary":"restrict_ip allowlist bypassed for API key, OAuth, and header-based authentication","details":"### Impact\r\n\r\n`restrict_ip` allowlist is bypassed for API key, OAuth, and header-based authentication.\r\n\r\n### Patches\r\n\r\nThe issue has been patched, updating to the latest versions of Frappe Framework should resolve this.\r\n\r\n### Workarounds\r\n\r\nThere are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.","categories":["Unclassified"],"product":"frappe","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q","source_modified_at":"2026-10-01T05:27:13Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"pip","name":"frappe"},"range":"<16.33.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q","source_modified_at":"2026-10-01T05:27:13Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"pip","name":"frappe"},"range":"<15.120.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q","source_modified_at":"2026-10-01T05:27:13Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"pip","name":"frappe"},"version":"16.33.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q","source_modified_at":"2026-10-01T05:27:13Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"ecosystem":"pip","name":"frappe"},"version":"15.120.0"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-01T05:27:13Z","modified_at":"2026-10-01T05:27:13Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/frappe/frappe/security/advisories/GHSA-h9jq-7pgf-hw8q","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-01T05:27:13Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T05:27:13Z","content_hash":"e0ac4ed72319ad79a267fd120588f6f65c63dbf15c8b4128d5fa494487d792bf"}}