CVE-2026-47185CWE-79CWE-863broken-access-controlcross-site-scripting

CVE-2026-47185

published August 7, 2026

CVSS
5.1
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-863 · Incorrect Authorization
Published
2026-08-07T02:17Z
References (2)
https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5 · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x · [email protected]
EPSS history
Timeline
  • 06 AUG 21:08Z
    Frappe Has Broken Access Control in its Workspace Save API
    cvelistv5