All vulnerabilities
GHSA-h9jq-7pgf-hw8q

frappe: restrict_ip allowlist bypassed for API key, OAuth, and header-based authentication

frappe
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in16.33.0Also 15.120.0GitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

restrict_ip allowlist is bypassed for API key, OAuth, and header-based authentication.

Patches

The issue has been patched, updating to the latest versions of Frappe Framework should resolve this.

Workarounds

There are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.

Text from GitHub Advisory Database

Affected versions 2

  • frappe, pip<16.33.0GitHub
  • frappe, pip<15.120.0GitHub