Medium severityNVD Advisory· Published Jun 12, 2026· Updated Jun 12, 2026
CVE-2026-44976
CVE-2026-44976
Description
Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1News mentions
1- Frappe: 11 Medium-Severity CVEs Disclosed in a Single Day — XSS, SQLi, IDOR, and Access-Control BugsVypr Intelligence · Jun 12, 2026