CVE-2026-49394: Frappe Auth Bypass Vulnerability

CVE-2026-49394 Overview

CVE-2026-49394 is an authorization bypass vulnerability in Frappe, a full-stack web application framework. The flaw exists in the update_page endpoint of the Workspace module. Prior to version 16.19.0, public workspaces did not enforce the required Workspace Manager edit check. An authenticated user without the Workspace Manager role could modify public workspaces intended for privileged administration. This weakness is classified as Missing Authorization [CWE-862]. The maintainers addressed the issue in Frappe 16.19.0.

Critical Impact
Authenticated low-privilege users can modify public workspaces without holding the Workspace Manager role, enabling tampering with shared UI configurations across all Frappe users.

Affected Products

Frappe framework versions prior to 16.19.0
Applications built on the Frappe framework (including Desk workspace functionality)
Deployments exposing the update_page Workspace endpoint to authenticated users

Discovery Timeline

2026-07-10 - CVE-2026-49394 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-49394

Vulnerability Analysis

The vulnerability resides in the update_page function within frappe/desk/doctype/workspace/workspace.py. The pre-patch logic only verified permissions for private workspaces owned by other users. It failed to gate edits to workspaces flagged as public. Any authenticated Frappe user could therefore invoke update_page against a public workspace and alter its structure, links, or shortcuts. Because public workspaces are rendered to every user of the Desk interface, unauthorized modifications propagate across the tenant. The issue affects integrity of shared UI state without directly exposing data confidentiality.

Root Cause

The original conditional branch in update_page checked not doc.get("public") in combination with the user check, which caused the guard to be skipped entirely for public workspaces. The Workspace Manager role requirement was documented but never enforced for public workspace edits. The fix adds an explicit branch that throws PermissionError when doc.get("public") is true and the caller is not a Workspace Manager.

Attack Vector

An attacker requires a valid authenticated session on the Frappe instance and network access to the Desk endpoints. No user interaction from an administrator is needed. The attacker calls update_page with the target workspace name and modified payload. The server accepts the request and persists the changes without validating the Workspace Manager role.

python

# Patch from frappe/desk/doctype/workspace/workspace.py
public = frappe.parse_json(public)
doc = frappe.get_doc("Workspace", name)

# Before (vulnerable):
# if not doc.get("public") and doc.get("for_user") != frappe.session.user and not is_workspace_manager():
#     frappe.throw(_("Need Workspace Manager role to edit private workspace of other users"), frappe.PermissionError)

# After (fixed):
if doc.get("public") and not is_workspace_manager():
    frappe.throw(_("Need Workspace Manager role to edit public workspaces."))
elif not doc.get("public") and doc.get("for_user") != frappe.session.user and not is_workspace_manager():
    frappe.throw(
        _("Need Workspace Manager role to edit private workspace of other users."),
        frappe.PermissionError,
    )

Source: GitHub commit 2471d94

Detection Methods for CVE-2026-49394

Indicators of Compromise

Unexpected modifications to public Workspace documents in the Frappe database, particularly changes to links, shortcuts, or charts fields
Audit log entries showing calls to the update_page endpoint from users lacking the Workspace Manager role
New or altered navigation items appearing in the Desk UI without a corresponding administrative change ticket

Detection Strategies

Enable Frappe's activity log and correlate Workspace DocType modification events against the acting user's role assignments
Alert on any POST /api/method/frappe.desk.doctype.workspace.workspace.update_page request where the session user is not a Workspace Manager
Baseline the current state of all public workspaces and diff periodically to identify drift outside change windows

Monitoring Recommendations

Ingest Frappe application logs and web server access logs into a centralized log platform for role-versus-endpoint correlation
Monitor tabWorkspace table writes in the underlying database for changes where public = 1
Track version deployment across Frappe instances to confirm all environments run 16.19.0 or later

How to Mitigate CVE-2026-49394

Immediate Actions Required

Upgrade Frappe to version 16.19.0 or later on all production and staging environments
Audit current Workspace Manager role assignments and remove the role from accounts that do not require it
Review all public workspaces for unauthorized modifications made prior to patching and restore known-good configurations

Patch Information

The vulnerability is fixed in Frappe 16.19.0. The remediation commits are 2471d94 and the version-16 backport 6eba29d, delivered through pull requests #39508 and #39526. Full details are available in the GitHub Security Advisory GHSA-r24j-xrj8-273q and the v16.19.0 release notes.

Workarounds

Restrict network access to the Frappe Desk interface to trusted administrators until the patch is applied
Reduce the number of authenticated users who can reach /api/method/frappe.desk.doctype.workspace.workspace.update_page via reverse-proxy allowlists
Implement a custom server hook or override that enforces is_workspace_manager() on public workspace edits as a temporary control

bash

# Verify installed Frappe version and upgrade using bench
bench version --format json | grep frappe
bench update --reset --patch
bench --site all migrate