CVE-2026-62315

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.31.1

Description Frappe is a full-stack web application framework. A type confusion issue exists in the set value() function within frappe/client.py. The system validates a dictionary provided via the fieldname parameter against forbidden standard and child-table fields before the dictionary is parsed into individual field names. An authenticated user can exploit this behavior to perform mass assignment of protected fields through the client endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.