PT-2026-57318 · Frappe · Frappe

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-49394

Mitre

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-49394

Produtos afetados

Frappe

Referências · 7

• https://github.com/frappe/frappe/security/advisories/GHSA-r24j-xrj8-273q · Nota
• https://github.com/frappe/frappe/releases/tag/v16.19.0 · Nota
• https://github.com/frappe/frappe/commit/6eba29d7ae80cdb4d0b2a245a477b1d2312736ca · Nota
• https://github.com/frappe/frappe/pull/39526 · Nota
• https://github.com/frappe/frappe/pull/39508 · Nota
• https://github.com/frappe/frappe/commit/2471d94c397dc23301b30ed3bb30353f53b33f2c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49394 · Nota de Segurança