CVE-2026-49394

Received Received - Intake

Authorization Bypass in Frappe Framework via Workspace

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-49394

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	to 16.19.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Frappe web application framework versions prior to 16.19.0. It involves an authorization bypass via the update_page endpoint in the Workspace feature. Specifically, public workspaces did not have the necessary Workspace Manager edit permission check, allowing unauthorized users to perform actions they should not be able to.

The issue was fixed in version 16.19.0 by adding the required authorization checks.

Impact Analysis

This vulnerability can allow unauthorized users to bypass authorization controls and update pages in public workspaces without proper permissions. This could lead to unauthorized modifications of content or configurations within the affected application.

Mitigation Strategies

To mitigate this vulnerability, update the Frappe framework to version 16.19.0 or later, where the authorization bypass issue via the update_page endpoint in Workspace has been fixed.

Hi! I’m here to help you understand CVE-2026-49394. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70