CVE-2026-31878 — Frappe: Possible SSRF by any authenticated user

CVE-2026-31878

Frappe: Possible SSRF by any authenticated user PUBLISHED

Description (CNA)

Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.

Affected (CNA)

Vendor / product	Versions
frappe / frappe	affected >= 16.0.0, < 16.6.0; affected >= 15.0.0, < 15.100.0; affected < 14.100.1

CWE

CWE-918

References

https://github.com/frappe/frappe/security/advisories/GHSA-mggg-hmjm-j6c2

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.