CVE-2026-39351

BRIEFING NOTE: CVE-2026-39351 Frappe, a full-stack web application framework, contains a critical API authentication bypass vulnerability affecting versions prior to 16.14.0 and 15.104.0 that allows attackers to gain unrestricted access to Doctype objects without proper authorization controls. The vulnerability enables unauthenticated remote exploitation over the network with no user interaction required, resulting in complete compromise of data confidentiality and integrity. With a CVSS score of 9.1 (Critical), the weakness is of the highest severity tier, though the EPSS score of 0.0004 indicates currently low exploitation probability relative to other known vulnerabilities. Presently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation or publicly available proof-of-concept code. Organizations running affected Frappe versions should prioritize patching to 16.14.0, 15.104.0, or later to mitigate this critical API security defect.