CVE-2026-31879

Received Received - Intake

Stored XSS and Unauthorized Workspace Modification in Frappe Framework

Publication date: 2026-03-11

Last updated on: 2026-03-13

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-11

Last Modified

2026-03-13

Generated

2026-07-06

AI Q&A

2026-03-11

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31879

EUVD

EUVD-2026-11292

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 14.100.2 (exc)
frappe	frappe	From 15.0.0 (inc) to 15.101.0 (exc)
frappe	frappe	From 16.0.0 (inc) to 16.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Compliance Impact

I don't know

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the frappe package to one of the fixed versions: 14.100.2, 15.101.0, or 16.10.0.

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-31879 is a vulnerability in the Frappe web application framework that occurs due to improper permission checks and lack of validation. This flaw allows users to modify other users' private workspaces by sending specially crafted requests."}, {'type': 'paragraph', 'content': 'Additionally, these crafted requests can lead to stored Cross-Site Scripting (XSS) attacks, where malicious scripts are injected and stored within the application, potentially affecting other users.'}, {'type': 'paragraph', 'content': 'This vulnerability affects versions prior to 14.100.2, 15.101.0, and 16.10.0 and has been fixed in these versions.'}] [1]

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to modify private workspaces that do not belong to them, potentially leading to data tampering or unauthorized data access.

The stored XSS aspect of the vulnerability can enable attackers to execute malicious scripts within the application context, which could lead to session hijacking, data theft, or other malicious activities affecting users.

Overall, this can compromise the confidentiality and integrity of user data within the Frappe application.

Detection Guidance

I don't know

Hi! I’m here to help you understand CVE-2026-31879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70