Stored XSS via Like Endpoint in Frappe Framework

Executive Summary

CVE-2026-53569 is a missing authorization vulnerability in the Frappe Framework versions 16.31.0 and earlier. The whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission checks before modifying _liked_by metadata or a Note seen state. This allows authenticated users to interact with documents or notes they cannot read, disclosing resource existence and altering metadata.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Frappe Framework version is 16.31.0 or earlier. Review logs for unauthorized access attempts to toggle_like or mark_as_seen endpoints. Look for users interacting with documents they lack read permissions for.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could exploit this to view the existence of restricted documents or notes and modify their metadata (e.g., like status or seen state) without proper read permissions. This could lead to information leakage or unauthorized changes to resource tracking.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements by allowing unauthorized access to sensitive data existence and metadata changes. GDPR requires strict access controls and data protection; HIPAA mandates safeguards for protected health information. Exploitation could lead to unauthorized data exposure or integrity breaches, risking non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update to the latest patched version of Frappe Framework to restore permission checks. If updating is not possible, restrict access to the toggle_like and mark_as_seen endpoints manually until an update is applied.

Useful 0 Not Useful 0