CVE-2026-47194 frappe CVE debrief

Who should care

Developers and administrators of applications built using the Frappe framework should assess their exposure and take immediate action to patch vulnerable systems. This includes reviewing system inventory, verifying Frappe framework versions, and applying necessary patches. Additionally, security teams and vulnerability management teams should prioritize verifying their Frappe framework versions and applying patches to prevent potential exploitation.

Why it matters

CVE-2026-47194 is a high-severity vulnerability in the Frappe web application framework that allows remote attackers to manipulate temporary magic login links, potentially leading to unauthorized access. Defenders should prioritize verifying their Frappe framework versions and applying the necessary patches to prevent potential exploitation.

• Potential unauthorized access to Frappe-based applications
• Possible capture of login tokens
• Need for verification of Frappe framework versions
• Priority patching required for versions prior to 15.108.0 and 16.18.3

Technical summary

The Frappe web application framework is vulnerable to a high-severity issue (CVSS Score: 8.6) that allows remote attackers to manipulate temporary magic login links. This can be done by controlling the request Host header, causing emailed login links to point to an attacker-controlled domain. When a recipient follows the link, the login token can be captured by the attacker. The issue is fixed in Frappe versions 15.108.0 and 16.18.3.

Defensive priority

Defenders should prioritize verifying their Frappe framework versions and applying the necessary patches to prevent potential exploitation.

Recommended defensive actions

• Verify Frappe framework version and apply patches
• Review system inventory for Frappe-based applications
• Monitor system logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed versions. However, additional information on potential exploitation or affected systems is limited. Defenders should verify Frappe framework versions and apply patches to prevent potential exploitation. The lack of detailed information on affected systems requires a cautious approach, with a focus on verifying system inventory and monitoring system logs for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.