CVE-2026-62315 PUBLISHED

Frappe: Mass assignment via set_value

Assigner: GitHub_M
Reserved: 13.07.2026 Published: 20.08.2026 Updated: 20.08.2026

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor frappe
Product frappe
Versions
  • Version <= 16.31.0 is affected

References

Problem Types

  • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE