Vulnerability Description
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Related Weaknesses (CWE)
References
- https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f
- https://github.com/frappe/frappe/pull/41361
- https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm
FAQ
What is CVE-2026-63654?
CVE-2026-63654 is a documented vulnerability. Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP me...
How severe is CVE-2026-63654?
CVSS scoring is not yet available for CVE-2026-63654. Check NVD for updates.
Is there a patch for CVE-2026-63654?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.