CVE-2026-31878 — Frappe: Possible SSRF by any authenticated user
Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the s…
Published: 2026-03-11 · CVSS: 5.0 · CVSS 3.1
Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7