CVE-2026-66002

CVE-2026-66002 is a user enumeration vulnerability in Frappe's PersonalDataDownloadRequest feature — the endpoint organizations deploy to satisfy GDPR Article 15 (right of access to personal data). The bug: the system returned visibly different responses depending on whether an email existed in the database, allowing anyone with the form URL and an email list to compile a roster of registered users. The patch normalized the response shapes, but the more important question is whether it also normalized the behavioral side channels. If registered and unregistered lookups still produce different database writes, audit log entries, or timing characteristics, an attacker with log access — including internal IT staff, monitoring systems, or third-party integrators — can still enumerate users. You need to verify that your patched version eliminated not just the visible API difference but the persistence-layer difference as well. The exposure is broader than a typical enumeration bug because this form is public-facing by design. Frappe powers ERPs and business applications where the PersonalDataDownloadRequest endpoint is intentionally accessible to the internet. The enumerated users aren't random accounts — they're people with formal legal relationships to your organization (employees, customers, contractors), making the output valuable for social engineering and supply-chain targeting. Action items: confirm your Frappe version is 15.115.0+ or 16.27.0+; audit the endpoint's behavioral side channels (check your database audit tables and application logs for differential write patterns between found and not-found responses); apply rate limiting if not already present; and document this as a deployment hardening requirement in your threat model, because the framework treats this as a legitimate public-facing feature rather than an enumeration risk.

Reviewed through automated stages and approved by a human before publication.