Advisory · CVE-2024-58390
Frappe privilege escalation from Website User to System Manager
Frappe before 14.81.4 and 15.x before 15.41.0 has an improper privilege management flaw in a document action that lets a Website User escalate to System Manager. CVSS 3.1 8.8.
- Vendor
- Frappe
- Product
- Frappe Framework
- Identifier / CWE
- CVE-2024-58390
CWE-269 - Action timing
- Immediate
Explain it like I’m five
The lowest rung on the Frappe ladder, a Website User, can use one document action plus a few steps to climb straight to System Manager.
- 01Website User account
An authenticated attacker with the Website User role reaches the affected document action.
- 02Privilege flaw
The document action mishandles privileges, and the attacker combines it with additional steps.
- 03System Manager
The attacker obtains administrative System Manager privileges in the Frappe application.
What happened
The Frappe project disclosed CVE-2024-58390 for the Frappe framework: versions before 14.81.4 and 15.x before 15.41.0 contain an improper privilege management vulnerability (CWE-269) involving a certain document action. Authenticated attackers with Website User access can combine the action with additional steps to obtain System Manager privileges.
Per the vendor’s affected data, upgrade to 14.81.4 or 15.41.0 or later for the respective lines.
What to do
- Inventory every Frappe Framework deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Frappe Framework while remediation is underway, especially for internet-facing instances.
- Review application and server logs for role changes granting System Manager, Website Users invoking document actions outside normal site use, and new admin accounts.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Frappe underpins ERPNext and many custom business apps. A Website User to System Manager path means public signups and admin control were separated by one flaw. Upgrade and audit roles.