CVE-2026-31879: Frappe Workspace modification and stored XSS due to improper resource ownership checks
Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31879?
CVE-2026-31879 has a high severity rating due to its potential for stored cross-site scripting and unauthorized access to user data.
How do I fix CVE-2026-31879?
To fix CVE-2026-31879, upgrade to Frappe version 14.100.2, 15.101.0, or 16.10.0 or later.
What types of applications are affected by CVE-2026-31879?
CVE-2026-31879 affects the Frappe application framework before versions 14.100.2, 15.101.0, and 16.10.0.
Who can exploit CVE-2026-31879?
Any user with access to the affected versions of Frappe could exploit CVE-2026-31879 to modify private workspaces.
What are the consequences of CVE-2026-31879?
The consequences of CVE-2026-31879 include unauthorized access to and modification of other users' private workspaces.