A flaw in the update_page endpoint of the Workspace module allows an attacker to modify pages without proper authorization checks. The missing Workspace Manager edit validation permits a user with insufficient privileges to exploit the endpoint, potentially altering application data and configuration. The weakness is a classic access control bypass, classified as CWE‑862.

The issue affects installations of the Frappe framework prior to version 16.19.0. In particular, any publicly exposed Workspace that does not explicitly protect the update_page route from unauthorized users is vulnerable. Users running the 16.18.x or earlier release series should verify their installation date and version.

The vulnerability carries a CVSS score of 7.1, indicating a high impact if successfully exploited. The EPSS score indicates a very low exploitation probability (less than 1%), but exploitation is still possible, and the bug is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can reach the vulnerable endpoint over the network, providing the request directly to the web application, and the lack of authentication checks means the attack can be performed by any user who can reach the site.