CVE-2026-49394 — Frappe: Auth. bypass via update_page
Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not…
Published: 2026-07-10 · CVSS: 7.1 · CVSS 4.0
Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public workspaces did not receive the required Workspace Manager edit check. This issue is fixed in version 16.19.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7