Authorization Bypass in Frappe Framework Affecting Public Workspaces
CVE-2026-49394

7.1HIGH

Key Information:

Vendor

Frappe

Status
Frappe
Vendor
CVE Published:
10 July 2026

What is CVE-2026-49394?

The Frappe framework, a full-stack web application platform, contains an authorization bypass vulnerability in its update_page endpoint specifically concerning public workspaces. Prior to version 16.19.0, these public workspaces did not enforce necessary edit checks for Workspace Managers, allowing unauthorized modifications. This issue has been addressed in version 16.19.0, where appropriate validations have been implemented to secure the update_page functionality against unauthorized access.

Affected Version(s)

frappe < 16.19.0

References

https://github.com/frappe/frappe/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/39508
x_refsource_MISC
https://github.com/frappe/frappe/pull/39526
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.