Junglewise Threat Intelligence

CVE-2026-49394: Frappe authorization bypass in Workspace update_page endpoint

CVE-2026-49394 · Severity: info · CVSS 7.1 · Published 2026-07-10

Technologies: Frappe. Vendors: Frappe.

Executive brief

Frappe, a web application framework, contained a security flaw where public workspaces could be modified by unauthorized users. Typically, only users with the 'Workspace Manager' role should be able to edit these shared areas, but a missing check allowed other users to bypass this restriction. An attacker could use this to alter the layout or content of public dashboards, potentially disrupting operations or misleading other users.

Technical details

An authorization bypass vulnerability existed in the Frappe web framework prior to version 16.19.0. The root cause was a missing permission check in the `update_page` endpoint within the Workspace Doctype (`frappe/desk/doctype/workspace/workspace.py`). While private workspaces were correctly restricted to their owners or managers, public workspaces did not verify if the requesting user possessed the `is_workspace_manager` role. A remote attacker with basic authenticated access (PR:L) could exploit this to modify public workspace configurations. The issue has been resolved by adding an explicit check for the Workspace Manager role when the `public` flag is set on a workspace document.

Affected products

  • Frappe Frappe < 16.19.0

Timeline

  • 2026-05-26: patched: Fix merged into develop and backported to version 16 hotfix branch.
  • 2026-05-27: advisory: Release v16.19.0 published.
  • 2026-07-10: disclosed: CVE-2026-49394 published.

References

Related threats