CVE-2026-62315
Received Received - Intake

Authentication Bypass via Field Mass Assignment in Frappe

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-62315
EUVD
EUVD-2026-63539

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe frappe to 16.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62315 is a mass assignment vulnerability in the Frappe Framework. It occurs in the frappe.client.set_value function where improper handling of fieldname parameters allows type confusion. Attackers can bypass security checks by sending malformed input like dictionaries or JSON strings to modify protected fields such as 'modified' or 'owner'.

Detection Guidance

To detect this vulnerability, check if your Frappe Framework version is 16.31.0 or earlier. Inspect the client.py file for the set_value function to verify if proper type checks for fieldnames are implemented. Look for attempts to modify protected fields like 'modified' or 'owner' through malformed input such as JSON arrays.

Impact Analysis

This vulnerability allows authenticated attackers to modify sensitive system fields without authorization. It could lead to unauthorized data changes, privilege escalation, or system compromise. Since it affects the client endpoint, any application using Frappe Framework versions 16.31.0 or earlier is at risk if exposed to untrusted input.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data modifications. GDPR requires data integrity and access controls, while HIPAA mandates strict access controls for protected health information. Exploitation could lead to unauthorized changes, breaching these regulations and potentially resulting in legal penalties or data breaches.

Mitigation Strategies

Update to the latest version of the Frappe Framework where the vulnerability has been patched. There are no available workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart