CVE-2026-47185

Received Received - Intake

Frappe Framework Workspace Save API Privilege Escalation

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-47185

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	16.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Frappe allows an authenticated user to modify another user's private workspace without proper authorization. The Workspace Save API does not verify workspace ownership, enabling unauthorized changes and potential script injection that persists.

Detection Guidance

Detecting this vulnerability requires checking the Frappe version in use. Compare your installed version against 16.18.0. If your version is below 16.18.0, the system is vulnerable. Run: bench version to check the Frappe version.

Impact Analysis

An attacker could alter your private workspace, inject malicious scripts, or steal sensitive data. This could lead to unauthorized access, data breaches, or further compromise of your Frappe instance.

Compliance Impact

This vulnerability may violate compliance requirements by enabling unauthorized data access or modification. GDPR and HIPAA require strict access controls and data integrity, which this flaw undermines.

Mitigation Strategies

Upgrade Frappe to version 16.18.0 or later immediately. This can be done using: bench update --pull. Ensure no unauthenticated users have access to the Workspace Save API endpoints.

Hi! I’m here to help you understand CVE-2026-47185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70