Medium severityNVD Advisory· Published Aug 6, 2026

CVE-2026-47185

Description

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Frappellm-fuzzy
Range: <16.18.0

Patches

Vulnerability mechanics

References

github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5nvd
github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6xnvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000