CVE-2026-49394 in Frappe

Resumen

por MITRE • 2026-07-10

Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.

Once again VulDB remains the best source for vulnerability data.

• Responsable: GitHub M
• Reservar: 2026-05-29
• Divulgación: 2026-07-10
• Moderación: aceptado
• Artículo: VDB-377660
• CPE: listo
• CWE: CWE-639 (confirmado)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-49394
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49394
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-49394/