Vulnerability in Frappe

CVE-2026-44976

Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any field in any Onboarding Step record. This issue has been patched in version 16.17.4.

EPSS: 0.003 (20.0th percentile) — read the EPSS interpretation.

Affected products

Frappe — versions < 16.17.4

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security-advisories@github.com (x_refsource_CONFIRM)