Frappe Framework Improper Permission Check Vulnerability Leading to Workspace Modification and Stored Cross-Site Scripting

A vulnerability in the Frappe web application framework allows users to modify other users' private workspaces due to improper permission checks and validation. This issue, present in versions prior to 14.100.2, 15.101.0, and 16.10.0, could be exploited through specially crafted requests, leading to stored cross-site scripting.

Impact

Exploitation of this vulnerability could result in unauthorized modification of private workspaces and the introduction of stored cross-site scripting, where malicious scripts are executed in the context of the user.

Remediation

Users are advised to upgrade to Frappe versions 14.100.2, 15.101.0, or 16.10.0.