PT-2026-57318 · Frappe · Frappe

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-49394

Mitre

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-49394

Affected Products

Frappe

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-49394 · Security Note
• https://github.com/frappe/frappe/security/advisories/GHSA-r24j-xrj8-273q · Note
• https://github.com/frappe/frappe/releases/tag/v16.19.0 · Note
• https://github.com/frappe/frappe/commit/6eba29d7ae80cdb4d0b2a245a477b1d2312736ca · Note
• https://github.com/frappe/frappe/pull/39526 · Note
• https://github.com/frappe/frappe/pull/39508 · Note
• https://github.com/frappe/frappe/commit/2471d94c397dc23301b30ed3bb30353f53b33f2c · Note