CVE-2026-31879
Stored XSS and Unauthorized Workspace Modification in Frappe Framework
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frappe | frappe | to 14.100.2 (exc) |
| frappe | frappe | From 15.0.0 (inc) to 15.101.0 (exc) |
| frappe | frappe | From 16.0.0 (inc) to 16.10.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade the frappe package to one of the fixed versions: 14.100.2, 15.101.0, or 16.10.0.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-31879 is a vulnerability in the Frappe web application framework that occurs due to improper permission checks and lack of validation. This flaw allows users to modify other users' private workspaces by sending specially crafted requests."}, {'type': 'paragraph', 'content': 'Additionally, these crafted requests can lead to stored Cross-Site Scripting (XSS) attacks, where malicious scripts are injected and stored within the application, potentially affecting other users.'}, {'type': 'paragraph', 'content': 'This vulnerability affects versions prior to 14.100.2, 15.101.0, and 16.10.0 and has been fixed in these versions.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to modify private workspaces that do not belong to them, potentially leading to data tampering or unauthorized data access.
The stored XSS aspect of the vulnerability can enable attackers to execute malicious scripts within the application context, which could lead to session hijacking, data theft, or other malicious activities affecting users.
Overall, this can compromise the confidentiality and integrity of user data within the Frappe application.