CVE-2026-50699 Overview
CVE-2026-50699 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Frappe Framework version 17.0.0-dev. An authenticated attacker with write access to the Auto Repeat document type can inject HTML or JavaScript into the reference_document field. The payload persists through a whitelisted write path and executes when another user opens the affected Auto Repeat form in the browser.
The flaw is medium severity and requires both high privileges and user interaction, which limits exploitation to insider or post-compromise scenarios. Successful exploitation can lead to session theft, unauthorized actions performed in the victim's context, and limited integrity impact across the application.
Critical Impact
Persistent script execution in authenticated user sessions enables account takeover and data exfiltration via the Frappe web interface.
Affected Products
- Frappe Framework version 17.0.0-dev
- Deployments exposing the Auto Repeat document type to non-administrative users
- Downstream applications built on Frappe that surface the Auto Repeat form (including ERPNext stacks)
Discovery Timeline
- 2026-06-24 - CVE-2026-50699 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-50699
Vulnerability Analysis
The vulnerability is a stored XSS in the Auto Repeat feature of Frappe Framework. Auto Repeat schedules the periodic creation of documents and references a target document through the reference_document field. The framework exposes a whitelisted write path that accepts data for this field without sufficiently sanitizing HTML or JavaScript content before persistence.
When a user later opens the saved Auto Repeat form, the client-side renderer reflects the stored value into the DOM. Browser parsing of the unsanitized markup triggers any embedded script, executing it under the origin of the Frappe application. The attacker inherits the victim's CSRF token, cookies, and role assignments for the duration of script execution.
Root Cause
The root cause is missing output encoding and input sanitization on the reference_document value within Auto Repeat. The whitelisted server method trusts the inbound payload from any authenticated principal that already possesses write permission on Auto Repeat. Frappe's general field rendering does not enforce HTML escaping for this attribute, allowing persisted markup to round-trip into the rendered form.
Attack Vector
The attack vector is network-based and requires high privileges plus user interaction. An attacker first obtains an account with write access to Auto Repeat. The attacker submits a malicious payload to the whitelisted write endpoint, storing JavaScript inside reference_document. Execution occurs when a privileged operator subsequently navigates to the affected Auto Repeat record, at which point the script runs with that user's session context.
No verified exploit code is publicly available for this CVE. Refer to the Fluid Attacks Security Advisory and the Frappe GitHub Project Repository for technical details.
Detection Methods for CVE-2026-50699
Indicators of Compromise
- Auto Repeat records where reference_document contains HTML tags, <script> fragments, javascript: URIs, or event handler attributes such as onerror and onload
- Audit log entries showing writes to Auto Repeat by accounts that do not normally administer scheduled documents
- Browser console errors or Content Security Policy violations triggered when users open Auto Repeat forms
Detection Strategies
- Query the Auto Repeat doctype for reference_document values containing angle brackets or known XSS sink keywords, and flag any matches for review
- Enable verbose request logging on whitelisted Frappe methods that mutate Auto Repeat and correlate writes with user role assignments
- Deploy a strict Content Security Policy in report-only mode to surface inline script execution originating from Auto Repeat views
Monitoring Recommendations
- Monitor Frappe application logs for unusual write activity on the Auto Repeat doctype, especially from accounts outside the scheduling team
- Alert on outbound HTTP requests originating from authenticated browser sessions to unfamiliar domains, which can indicate token or cookie exfiltration
- Track creation and modification timestamps of Auto Repeat records and compare against change-management approvals
How to Mitigate CVE-2026-50699
Immediate Actions Required
- Restrict write permission on the Auto Repeat doctype to a minimal set of trusted administrators using Frappe's Role Permissions Manager
- Audit existing Auto Repeat records and sanitize or delete entries containing HTML or script content in reference_document
- Rotate session tokens and API keys for any user who opened a suspicious Auto Repeat form before remediation
Patch Information
No official patched version is referenced in the published CVE record at the time of writing. Track the Frappe GitHub Project Repository for fixes that update sanitization of the Auto Repeat reference_document field, and upgrade away from the 17.0.0-dev pre-release build to a stable release once available.
Workarounds
- Remove the Auto Repeat write privilege from all non-administrator roles until a patched release is deployed
- Apply a server-side hook to validate that reference_document matches an existing doctype name pattern and rejects any value containing angle brackets or scheme prefixes
- Enforce a Content Security Policy that disallows inline scripts (script-src 'self') to neutralize stored payloads in the browser
# Example: restrict Auto Repeat write access via bench console
bench --site yoursite.local console
# Inside the console:
# import frappe
# frappe.db.sql("DELETE FROM `tabCustom DocPerm` WHERE parent='Auto Repeat' AND role!='System Manager' AND `write`=1")
# frappe.db.commit()
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
