CVE-2026-47185

CVE-2026-47185 is an IDOR vulnerability in Frappe's Workspace Save API that permits an authenticated user to modify workspace configurations belonging to other users. When combined with persistent script injection — the workspace name is rendered without sanitization in the UI — this becomes IDOR-to-stored-XSS. A low-privilege user can inject malicious JavaScript that executes in the browser of any user who accesses the compromised workspace, including administrators. The CVSS 5.1 rating reflects a single-instance exploit scenario and significantly understates the risk for multi-tenant Frappe deployments, which represent the framework's primary deployment model. In multi-tenant setups, one user's workspace modification can affect other users on the same instance, multiplying the blast radius well beyond what the CVSS suggests. The root cause is structural, not incidental: Frappe's Workspace Save API accepts a user-supplied workspace identifier as authoritative, placing the entire authorization burden on application code rather than enforcing ownership at the framework layer. This is the same pattern that has produced IDOR vulnerabilities in Django, Rails, and Laravel — a genealogy that indicates the fix applied at a single endpoint does not resolve the underlying design weakness. If you run Frappe, prioritize these actions: First, verify your Frappe version — version 16.18.0 or later includes the patch. Second, examine whether the fix implements ownership checks at the framework layer (enforced automatically) or merely documents that developers should add validation (leaving the gap open). If it's the latter, your deployment remains structurally vulnerable regardless of version number. Third, assume that any authenticated user with knowledge of this vulnerability can modify workspaces they don't own until proven otherwise — treat the exposure as broader than the specific API endpoint. Fourth, audit private workspaces belonging to administrators, as these are high-value targets for XSS injection that could yield session cookies or API keys. Finally, monitor for unexpected workspace modifications in your access logs, particularly POST requests to the workspace save endpoint with identifiers that don't correspond to the requesting user's owned workspaces. The EPSS score of 0.00393 likely reflects delayed PoC availability rather than genuinely low exploitability. Framework-level IDOR requires understanding the framework's API conventions, which creates a knowledge barrier that delays automated exploitation — but that barrier collapses quickly once tooling surfaces. The vulnerable population (Frappe instances below 16.18.0) is self-selected for enterprise deployments where the data justifies targeted exploitation.

Reviewed through automated stages and approved by a human before publication.