CVE-2026-63654

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

CVSS

No CVSS.

References

Link	Resource
https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f
https://github.com/frappe/frappe/pull/41361
https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Frappe es un framework de aplicación web full-stack. En la versión 16.31.0 y anteriores, el endpoint frappe.model.workflow.bulk_workflow_approval, incluido en la lista blanca, en frappe/model/workflow.py acepta métodos HTTP seguros para aprobaciones de flujo de trabajo que cambian de estado porque el endpoint no está restringido a POST. Un atacante puede inducir a un navegador de la víctima autenticado a enviar una acción de aprobación con los privilegios de la víctima. No hay ninguna versión corregida publicada disponible a partir de esta revisión.

Information

Published : 2026-08-20 19:16

Updated : 2026-10-26 10:10

NVD link : CVE-2026-63654

Mitre link : CVE-2026-63654

CVE.ORG link : CVE-2026-63654

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-63654", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63654", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:47:26.907767Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "frappe", "versions": [{"status": "affected", "version": "<= 16.31.0"}]}]}], "published": "2026-08-20T19:16:57.570", "references": [{"url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f", "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/frappe/pull/41361", "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."}, {"lang": "es", "value": "Frappe es un framework de aplicaci\u00f3n web full-stack. En la versi\u00f3n 16.31.0 y anteriores, el endpoint frappe.model.workflow.bulk_workflow_approval, incluido en la lista blanca, en frappe/model/workflow.py acepta m\u00e9todos HTTP seguros para aprobaciones de flujo de trabajo que cambian de estado porque el endpoint no est\u00e1 restringido a POST. Un atacante puede inducir a un navegador de la v\u00edctima autenticado a enviar una acci\u00f3n de aprobaci\u00f3n con los privilegios de la v\u00edctima. No hay ninguna versi\u00f3n corregida publicada disponible a partir de esta revisi\u00f3n."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "security-advisories@github.com"}