CVE-2026-62315

Description

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

Is your site exposed to CVE-2026-62315?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0028

Probability of exploitation

0.21%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-915 CWE-915

References

Other References

https://github.com/frappe/frappe/commit/2a04fae9353c02f0a9ce9f40f92c1eba6765c77b https://github.com/frappe/frappe/pull/38951 https://github.com/frappe/frappe/security/advisories/GHSA-2c6h-wv85-fxvj

Frequently Asked Questions

What is CVE-2026-62315? +

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An authenticated caller can exploit this type confusion to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

How do I check if I'm vulnerable to CVE-2026-62315? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-114573

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus …

CVE-2026-61598

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.mixins.model_binding.ModelBindingMixin` provides a default …

CVE-2026-78038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option …

CVE-2026-104908

MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create …

CVE-2026-103235

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation …

CVE-2026-105863

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom …