Frappe Document Sharing Vulnerability Allowing Improper Permission Granting

A broken access control vulnerability has been identified in the Frappe web application framework, affecting versions prior to 15.98.0 and 14.100.0. The issue arises from insufficient validation during the document sharing process, allowing users to share documents with permissions they did not possess. This vulnerability has been addressed in versions 15.98.0 and 14.100.0.

Impact

Exploitation of this vulnerability could lead to unauthorized permission grants, allowing users to access or modify documents beyond their intended rights.

Remediation

Users are advised to upgrade to Frappe versions 15.98.0 or 14.100.0.