CVE-2024-58390

Summary

A privilege escalation vulnerability in Frappe allows Website Users to gain full System Manager administrative access through a specific document action. This means attackers with basic website user accounts can escalate their privileges to gain complete control over the application.

Exploitability

The exploit is relatively straightforward for authenticated attackers who already have a Website User account, requiring only a specific document action combined with additional steps to achieve System Manager privileges.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise Frappe applications by gaining administrative access, potentially leading to data breaches, unauthorized modifications, and complete system control.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Frappe 14.81.4 or 15.41.0 to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.