Executive brief
Frappe is a full-stack web framework used to build business applications. An authenticated attacker can bypass field-level protection controls through a type confusion flaw in the client API, allowing them to modify protected fields that should normally be read-only. This could lead to unauthorized changes to sensitive application data or configuration.
Technical details
The vulnerability exists in frappe/client.py's set_value function, which fails to properly validate fieldname parameters when supplied as a dictionary. The function checks for forbidden fields before parsing dictionary input into individual field names, allowing an attacker to exploit type confusion and mass-assign protected standard and child-table fields. The vulnerability requires prior authentication to the Frappe instance and network access to the client endpoint. A fix was merged to the develop branch in June 2026 but no released fixed version is available as of the advisory date.
Affected products
- Frappe Frappe 16.31.0 and earlier
Timeline
- 2026-08-20: disclosed
- 2026-06-26: patched: Commit merged to develop branch, no released version available