EUVD-2026-54152Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API requires authenticated low-privilege user (PR:L); victim must view workspace to trigger stored XSS (UI:R); script executes in victim's session crossing scope boundary (S:C), enabling session theft (C:L) and workspace content tampering (I:L).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.
AnalysisAI
Workspace Save API in Frappe prior to version 16.18.0 permits any authenticated user to overwrite another user's private workspace by supplying an arbitrary workspace identifier, and to inject persistent malicious scripts into that workspace. The root cause is a missing ownership check in the save_page handler in frappe/desk/doctype/workspace/workspace.py, confirmed by the vendor fix and classified as stored XSS (CWE-79). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity for any authenticated user and the persistent, targeted nature of the injection make it a meaningful risk in all multi-user Frappe and ERPNext deployments.
Technical ContextAI
Frappe is a Python/JavaScript full-stack web framework that underpins ERPNext and a broad ecosystem of business applications. The vulnerable component is the save_page function in frappe/desk/doctype/workspace/workspace.py, which accepts a client-controlled name parameter identifying the target workspace document without verifying that the requesting session user owns that document. Because Frappe workspaces persist blocks and widget configurations that are subsequently rendered in the browser, an attacker can embed arbitrary JavaScript in a victim's workspace document. When the victim opens their workspace, the injected script executes in their authenticated browser session - a classic stored XSS pattern. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), confirmed by the vendor's XSS tag and the nature of the fix, which introduces is_workspace_manager() and doc.for_user == frappe.session.user ownership assertions before persisting workspace content.
RemediationAI
Upgrade Frappe to version 16.18.0 or later, which is the vendor-confirmed fixed release. The patch introduces an ownership check in save_page that enforces is_workspace_manager() and doc.for_user == frappe.session.user before persisting workspace content; the fix commit is available at https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5. The full security advisory is at https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x. If immediate patching is not feasible, a compensating control is to revoke write access to the Workspace doctype for all untrusted roles at the Frappe permission level - this eliminates workspace save access entirely for those roles but also disables legitimate workspace customization, which is a significant functional trade-off. Network-perimeter controls are ineffective because the attack originates from authenticated internal users via standard API requests.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today