CVE-2026-31879
Received Received - Intake
Stored XSS and Unauthorized Workspace Modification in Frappe Framework

Publication date: 2026-03-11

Last updated on: 2026-03-13

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31879
EUVD
EUVD-2026-11292
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
frappe frappe to 14.100.2 (exc)
frappe frappe From 15.0.0 (inc) to 15.101.0 (exc)
frappe frappe From 16.0.0 (inc) to 16.10.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the frappe package to one of the fixed versions: 14.100.2, 15.101.0, or 16.10.0.

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-31879 is a vulnerability in the Frappe web application framework that occurs due to improper permission checks and lack of validation. This flaw allows users to modify other users' private workspaces by sending specially crafted requests."}, {'type': 'paragraph', 'content': 'Additionally, these crafted requests can lead to stored Cross-Site Scripting (XSS) attacks, where malicious scripts are injected and stored within the application, potentially affecting other users.'}, {'type': 'paragraph', 'content': 'This vulnerability affects versions prior to 14.100.2, 15.101.0, and 16.10.0 and has been fixed in these versions.'}] [1]

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to modify private workspaces that do not belong to them, potentially leading to data tampering or unauthorized data access.

The stored XSS aspect of the vulnerability can enable attackers to execute malicious scripts within the application context, which could lead to session hijacking, data theft, or other malicious activities affecting users.

Overall, this can compromise the confidentiality and integrity of user data within the Frappe application.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31879. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart