PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-81731 frappe CVE debrief

The CVE-2026-81731 vulnerability affects Frappe versions 15.11.0 through 16.32.0, allowing stored XSS attacks via the Workspace Link doctype description field. This field's 'ignore_xss_filter' flag enables arbitrary markup injection by users with the Workspace Manager role, potentially leading to session token theft and authenticated requests as victims. Organizations should prioritize patching and restrict Workspace Manager role assignments.

Vendor
frappe
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-27
Original CVE updated
2026-08-31
Advisory published
2026-08-27
Advisory updated
2026-08-31

Who should care

Organizations using Frappe versions 15.11.0 through 16.32.0, particularly those with users holding the Workspace Manager role, should be aware of this vulnerability and take steps to mitigate it. This includes applying patches, restricting role assignments, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize this vulnerability and ensure that affected systems are properly secured.

Technical summary

The description field of the Workspace Link doctype in Frappe versions 15.11.0 through 16.32.0 is vulnerable to stored XSS due to the 'ignore_xss_filter' flag. A user with the Workspace Manager role can inject arbitrary markup, which can execute in the sessions of other users, including higher-privileged users, allowing for session token theft and authenticated requests as the victim. The vulnerability is caused by the lack of proper input validation and sanitization in the Workspace Link doctype.

Defensive priority

Organizations using Frappe versions 15.11.0 through 16.32.0 should prioritize patching to prevent XSS attacks.

Recommended defensive actions

  • Apply the patch from commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a
  • Update to a version of Frappe outside the vulnerable range (15.11.0 - 16.32.0)
  • Restrict Workspace Manager role assignments
  • Monitor for suspicious activity in user sessions
  • Implement additional logging and monitoring for user interactions with the Workspace Link doctype
  • Conduct regular security audits to identify potential vulnerabilities
  • Review and update incident response plans to address potential XSS attacks

Evidence notes

The description field of the Workspace Link doctype in Frappe versions 15.11.0 through 16.32.0 is vulnerable to stored XSS due to the 'ignore_xss_filter' flag. A user with the Workspace Manager role can inject arbitrary markup, which can execute in the sessions of other users, including higher-privileged users, allowing for session token theft and authenticated requests as the victim.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-81731 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-81731

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-81731 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-81731

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.