The flaw in Frappe version 16.31.0 and earlier allows an authenticated caller to supply a dictionary through the fieldname parameter that bypasses standard and child-table field checks. This type confusion enables the client endpoint to assign values to fields that are normally protected, effectively granting the caller partial write access to sensitive data or configuration. The vulnerability is specific to the set_value function and can compromise the integrity of application data.

Frappe frappe framework. The vulnerability affects all installations using the default client.set_value implementation in versions up to and including 16.31.0. No fixed version is currently available, so every instance running a version at or below this threshold is potentially exposed.

The CVSS score of 7.1 indicates a high impact; however, without an EPSS score, the probability of exploitation remains unknown. Because the flaw requires authenticated access to the client endpoint, attackers must first compromise a legitimate user account or obtain credentials. The exploitability is limited to systems where users have the ability to invoke client.set_value, but once an attacker can do so, protected fields can be overwritten. The lack of an EPSS score or KEV listing suggests there is no current evidence of active exploitation, yet the high severity and authenticated nature of the attack warrant prompt attention.