Frappe privilege escalation grants Website Users System Manager access (CVE-2024-58390)

What happened

The CVE record describes improper privilege management in Frappe, under CWE-269. An authenticated attacker with the Website User role can use a particular document action, then combine it with additional steps to obtain System Manager privileges. This takes the attacker from a limited account to administrative control of the Frappe application.

The CVSS 4.0 score is 8.7 (high). The vector indicates the flaw is reachable over the network, with low attack complexity, no attack requirements and no user interaction once the attacker holds a low-privileged account. On the vulnerable system, confidentiality, integrity and availability are all rated high; there is no impact on subsequent systems.

The CVE record and linked references do not report active exploitation of this flaw.

Who is affected

Affected versions are Frappe before 14.81.4 and 15.0.0 to before 15.41.0. This matters for deployments where users can obtain the Website User role, including ERPNext installations running on an affected Frappe version.

What to do now

No workaround is published for this CVE.

1. Patch Frappe to a fixed release: 14.81.4 for 14.x deployments, or 15.41.0 for 15.x deployments.
2. Identify all Frappe instances in your environment. For ERPNext installations, confirm the underlying Frappe version.
3. Review accounts that hold the Website User role and remove or suspend any that are not required until patching is complete.
4. After patching, audit System Manager assignments for unexpected changes.

How to detect it

The linked advisory and references do not provide vendor indicators of compromise. As a practical check, review role and permission logs for Website User accounts that become System Manager, and investigate any such change that was not authorised.

Beyond the patch

Privilege escalation from a low-trust public role matters because it turns a web-facing account into full administrative access without needing another vulnerability. Managed Detection & Response (MDR) can monitor for the privilege-elevation and follow-on activity this kind of flaw leaves, and Supply Chain Defense & Third-Party Risk helps track the patch exposure window across suppliers such as Frappe.