Frappe Framework CVE-2026-81731

Exploitation requires the attacker to hold the Workspace Manager role within the Frappe instance - a standard desk role distinct from System Manager, commonly assigned to power users who customize workspaces. The targeted workspace must be configured as a public workspace so that higher-privileged desk users encounter the injected card. Victim interaction is mandatory: the target user must open the workspace and hover over the specific card whose description contains the payload, triggering the Bootstrap popover rendering. There is no exploit path through the guest or portal interface; the attack is confined to authenticated desk users. The vulnerability is version-bounded to 15.11.0-16.32.0; instances running the development branch with the fix commit applied are not affected. No special network position, operating system, or database backend is required - the entire attack is delivered through standard Frappe desk HTTP interactions.

The CVSS 4.0 score of 5.1 (Medium) correctly captures the attack profile: network-accessible (AV:N), low complexity (AC:L), requiring low privileges (PR:L - Workspace Manager role), and passive victim interaction (UI:P - hover to trigger popover). The impacts are bounded at VC:L/VI:L for the victim system and SC:L/SI:L for the subsequent system (attacker gains victim session). EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified. CISA KEV status is not referenced, meaning active exploitation is unconfirmed at time of analysis. Despite the moderate CVSS score, the real-world risk warrants elevated priority for two compounding reasons: (1) the Workspace Manager role is a routine desk role assigned to non-administrator users in many Frappe deployments, lowering the attacker prerequisite bar significantly, and (2) no released patch exists - all deployed 15.x and 16.x instances remain vulnerable with no vendor-released upgrade path. The victim's session may belong to a System Manager or administrator, amplifying the realized impact well beyond the stored-XSS base score. The UI:P requirement prevents fully automated mass exploitation but does not meaningfully protect against a deliberate insider or compromised-account attack where workspace poisoning is persistent.

A Frappe user with the Workspace Manager role edits a public workspace and sets the description of a workspace link card to a JavaScript payload such as a cookie-exfiltration script targeting frappe.boot.user.sid. When a System Manager later opens the same workspace and hovers over the card, the Bootstrap popover renders the injected HTML and the script executes in the System Manager's browser session, transmitting their session token to an attacker-controlled server. The attacker replays the token to call authenticated Frappe REST API endpoints as the System Manager, creating new administrator accounts or exfiltrating sensitive business data.