# CVE-2026-50698: Frappe Framework stored XSS in Audit Trail

Source: https://junglewise.ai/threats/cve-2026-50698-frappe-framework-stored-xss-in-audit-trail  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-50698 · Severity: info · CVSS 4.6 · Published 2026-06-24

Frappe Framework, a low-code web framework used for building business applications, is vulnerable to a security flaw in its Audit Trail component. An attacker with high-level administrative privileges can inject malicious scripts into the system that will execute when other users view the audit logs. This could lead to unauthorized actions being performed in the context of the victim's session or the theft of sensitive information displayed in the management interface.

Technologies: [Frappe Technologies Frappe Framework](https://junglewise.ai/threats/technologies/frappe-framework). Vendors: [Frappe Technologies](https://junglewise.ai/threats/vendors/frappe-technologies).

## Quick answers

**Is CVE-2026-50698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50698 being exploited in the wild.

**How severe is CVE-2026-50698?** Informational severity, with a CVSS score of 4.6, published 24 June 2026.

**Which products and versions are affected?** Frappe Technologies Frappe Framework 17.0.0-dev.

**Is there a fix for CVE-2026-50698?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50698 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50698?** Check whether you run Frappe Technologies Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in Frappe Framework version 17.0.0-dev. The flaw is located within the Audit Trail component, where user-controlled input is improperly neutralized before being rendered as HTML output in templates. An attacker with high privileges (PR:H) can exploit this by injecting malicious JavaScript that is stored on the server. The payload executes when an authorized user interacts with the affected Audit Trail page. According to the CVSS 4.0 score provided by the CNA, the impact is limited to a low-integrity and low-confidentiality breach of the subsequent system (SC:L/SI:L).

## Affected products

- Frappe Frappe Framework 17.0.0-dev

## Timeline

- 2026-06-24: disclosed: Advisory published by Fluid Attacks and NVD

## References

- [https://fluidattacks.com/es/advisories/rufus](https://fluidattacks.com/es/advisories/rufus)
- [https://github.com/frappe/frappe](https://github.com/frappe/frappe)

## Related threats

- [Frappe Framework user enumeration in reset_password endpoint](https://junglewise.ai/threats/cve-2026-58503-frappe-framework-user-enumeration-in-reset-password-endpoint)
- [Frappe Framework missing authorization in file-handling API](https://junglewise.ai/threats/cve-2026-48127-frappe-framework-missing-authorization-in-file-handling-api)
- [Frappe Framework missing authorization in reportview](https://junglewise.ai/threats/cve-2026-47422-frappe-framework-missing-authorization-in-reportview)
- [Frappe Framework SQL injection via SELECT INTO OUTFILE in safe_exec](https://junglewise.ai/threats/cve-2026-47199-frappe-framework-sql-injection-via-select-into-outfile-in-safe)
- [Frappe path traversal in download_backups](https://junglewise.ai/threats/cve-2026-42219-frappe-path-traversal-in-download-backups)