AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-47185

MEDIUM · CVSS 5.1 EPSS 0.39% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-06 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The Workspace Save API in Frappe prior to version 16.18.0 is vulnerable to unauthorized modifications, as it allows any authenticated user to manipulate another user's private workspace due to insufficient ownership checks. This flaw can lead to persistent script injection, potentially compromising user data and application integrity. Organizations using affected versions should prioritize upgrading to 16.18.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-47185
Severity
MEDIUM
CVSS
5.1
EPSS
0.39%

Original NVD Description

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.