Frappe Framework EUVD-2026-36493

Exploitation requires a valid, authenticated user session in the Frappe application (PR:L in the CVSS 4.0 vector); unauthenticated access is not sufficient. The attacker must be able to log into the Frappe instance with any account, including the lowest-privilege roles. No special configuration, non-default feature flag, or specific module needs to be enabled - the Onboarding Step doctype is a core framework component present in all standard Frappe installations. Exploitation is limited by the requirement for at least one valid user credential; external, unauthenticated attackers are not exposed to this flaw. Impact is also bounded to the Onboarding Step doctype and does not cascade to other system records.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) yields a score of 5.3, reflecting a network-accessible, low-complexity flaw requiring only low privileges with no user interaction and a limited integrity-only impact. Real-world risk is further moderated by the EPSS score of 0.02% at the 5th percentile, indicating this CVE is highly unlikely to be targeted opportunistically in the near term. The absence of KEV listing and no identified POC reinforce a low operational urgency classification. The integrity impact (VI:L) is constrained to Onboarding Step record fields and does not extend to core application data, financials, or system configuration, limiting blast radius. Overall, while the access control bypass is a genuine defect, it represents a low-to-medium real-world priority - the CVSS score is consistent with its actual risk profile, and immediate emergency patching is not indicated unless Frappe is used in a highly multi-tenant or adversarial user environment.

An authenticated low-privileged user - such as a standard employee or guest account in an ERPNext deployment - directly submits a crafted write request to the Frappe REST API targeting an Onboarding Step record, supplying modified field values such as altered step titles, instructions, or completion states. No public POC has been identified, but the attack requires no technical sophistication beyond knowing the doctype name and the standard Frappe API structure. The attacker could silently falsify onboarding completion records or corrupt guided setup flows for other users.