Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31878Frappe: Possible SSRF by any authenticated user

Medium 5.0

In plain English

A medium-severity server-side request forgery in frappe from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 88.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 14.100.1, 15.100.0, and 16.6.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	frappe	>= 16.0.0, < 16.6.0>= 15.0.0, < 15.100.0< 14.100.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References

https://github.com/frappe/frappe/security/advisories/GHSA-mggg-hmjm-j6c2 x_refsource_CONFIRM