CVE-2026-62315
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Frappe version 16.31.0 and earlier has a type confusion vulnerability in frappe.client.set_value, which checks a dictionary supplied via the fieldname parameter against forbidden fields before parsing it into individual field names. An authenticated caller can exploit this to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.
Risk Assessment
An authenticated user can modify protected fields, potentially leading to privilege escalation or data integrity compromise.
Recommendation
Monitor vendor announcements and apply the fix when available; temporarily restrict access to the client endpoint for unauthorized users.
Other vulnerabilities in Frappe
See all- CVE-2017-1000120High
In Frappe versions up to 7.1.27, there is an SQL injection vulnerability in the frappe.share.get_users function that allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
- CVE-2026-119145Critical
Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because file-upload handling does not validate the destination path before writing to disk. An authenticated attacker can upload crafted files outside the intended storage directory to achieve remote code execution on the server.
- CVE-2026-39351Critical
Frappe prior to versions 16.14.0 and 15.104.0 has a vulnerability allowing unrestricted Doctype access via API exploit.
- CVE-2025-68929Critical
Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.
- CVE-2026-66057Medium
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
- CVE-2026-55823High
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.
- CVE-2026-109602Medium
Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.
- CVE-2026-109599Medium
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
- CVE-2025-71431Medium
Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.
- CVE-2025-71430Medium
Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.
Original NVD description (English source)
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS