Type Confusion Vulnerability in Frappe Framework by Frappe Technologies

CVE-2026-62315

What is CVE-2026-62315?

In Frappe Framework versions 16.31.0 and earlier, a vulnerability exists within the frappe.client.set_value method located in frappe/client.py. This issue arises from improper validation of the dictionary supplied via the fieldname parameter, allowing an authenticated user to exploit this type confusion. By doing so, they can perform mass assignment of protected fields through the client endpoint. No patched version has been released at this time, which leaves a significant security gap for users relying on these versions.

References