CVE-2026-41317CWE-352

Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation

Medium · published April 24, 2026

CVSS v4.0
6.6
EPSS
0%
Percentile
8.5
In the wild
Unconfirmed
What it is

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.

The record
Technical detail
CVSS v4.0
6.6 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00193 · 8.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-04-24T02:40Z
EPSS history
Timeline
  • 24 APR 02:40Z
    Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
    cvelistv5