What is CVE-2026-31879?

CVE-2026-31879 is a medium-severity vulnerability in Frappe, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-11.

How severe is CVE-2026-31879?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Frappe

CVE-2026-31879

Frappe is a full-stack web application framework. Prior to 14.100.2, 15.101.0, and 16.10.0, due to a lack of validation and improper permission checks, users could modify other user's private workspaces. Specially crafted requests could lead to stored XSS here. This vulnerability is fixed in 14.100.2, 15.101.0, and 16.10.0.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (3.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Frappe — versions < 16.10.0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-31879?: CVE-2026-31879 is a medium-severity vulnerability in Frappe, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-11.
How severe is CVE-2026-31879?: Medium severity. CVSS v3 base score is 5.4 out of 10.