CVE-2026-62315: Frappe: Mass assignment via set_value
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to call the Frappe client endpoint. The issue affects Frappe version 16.31.0 and earlier.
What access does exploitation provide?
A successful attacker can use type confusion in the fieldname parameter to mass-assign protected fields through frappe.client.set_value.
Is a fixed release available?
No released fixed version was available as of the review.