Frappe privilege escalation to System Manager via document action (CVE-2024-58390)

What happened

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action. A user with Website User access can combine this document action with additional steps to obtain System Manager privileges in the Frappe application.

The CVSS 4.0 score is 8.7 (high). The attack is possible from the network, requires low privileges and no user interaction, and has high impact on the confidentiality, integrity and availability of the vulnerable system. The CVE record describes an authenticated escalation path rather than a remote unauthenticated compromise.

The linked advisories do not state that this vulnerability has been exploited in the wild or publicly disclosed, and CISA KEV does not list it.

Who is affected

Affected versions are Frappe before 14.81.4, and 15.0.0 through versions before 15.41.0. Check the version of the frappe framework in your deployment. The relevant starting point for the escalation is having accounts with the Website User role, because the described attack begins from that role.

What to do now

1. Update Frappe to a fixed version: 14.81.4 for 14.x, or 15.41.0 for 15.x. These are the fixed versions listed in the references.
2. While the update is being prepared, review which accounts hold the Website User role and remove or restrict that role where it is not needed.
3. After updating, review accounts that hold the System Manager role and confirm that all of them are legitimate.

The sources do not describe a workaround; treat the version update as the corrective action.

Beyond the patch

Privilege escalation from a low-level Website User to System Manager is misuse of the application's own permissions, so rotating credentials alone will not close it. After the patch, Managed Detection & Response (MDR) can monitor for the account and role changes that follow this type of abuse, and Supply Chain Defense & Third-Party Risk can help track the Frappe versions in your estate and how quickly fixes ship for the components you run.