PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44976 frappe CVE debrief

CVE-2026-44976 is a vulnerability in Frappe, a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Vendor
frappe
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-12
Advisory published
2026-06-12
Advisory updated
2026-06-12

Who should care

Users of Frappe framework, especially those who have not upgraded to version 16.17.4 or later.

Technical summary

The vulnerability allows any user to modify any field in any Onboarding Step record in Frappe versions prior to 16.17.4. This issue has been patched in version 16.17.4.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to Frappe version 16.17.4 or later.
  • Review and restrict user permissions for modifying Onboarding Step records.

Evidence notes

The vulnerability is patched in version 16.17.4. For more information, see resourceLinkAnnotations with id 'ref-4'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44976 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44976

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44976 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44976

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.