Is CVE-2026-111388 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111388?

CVE-2026-111388 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-111388

Description

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist, defeating the configured network-based access restrictions.