CVE-2026-63654CWE-352csrf

CVE-2026-63654

published August 20, 2026

CVSS
6.9
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-20T23:16Z
References (3)
https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f · [email protected]https://github.com/frappe/frappe/pull/41361 · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm · [email protected]
EPSS history
Timeline
  • 20 AUG 18:23Z
    Frappe: Unauthenticated Workflow approval via confirm_action
    cvelistv5