CVE-2026-63654 in Frappe
Summary
by MITRE • 08/20/2026
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Frappe versions 16.31.0 and earlier centers on a critical misconfiguration within the framework's workflow management module, specifically affecting the bulk_workflow_approval endpoint located at frappe/model/workflow.py. As a full-stack web application framework, Frappe relies heavily on strict HTTP method enforcement to distinguish between safe read operations and dangerous state-changing write operations. The core technical flaw lies in the fact that this specific whitelisted endpoint does not restrict incoming requests to the POST method alone. Instead, it accepts any standard HTTP method deemed safe by typical browser behaviors or client libraries, such as GET or HEAD, which are traditionally intended for retrieving data without side effects. This deviation from secure coding practices creates a significant attack vector where an attacker can manipulate the expected behavior of web clients interacting with the application.
From an operational perspective, this flaw enables a classic Cross-Site Request Forgery scenario against authenticated users. Because the endpoint accepts methods that browsers might automatically trigger or allow via simple form submissions without requiring explicit user interaction beyond loading a page or clicking a link, an attacker can craft malicious content to induce a victim's browser to submit approval actions for workflow states. Since Frappe authenticates requests based on session cookies or tokens stored in the victim's browser, any request originating from that browser is treated as legitimate and authorized under the victim's privileges. Consequently, an unauthenticated remote attacker can force an authenticated user to approve workflows they did not intend to approve, effectively bypassing authorization controls through social engineering or automated exploitation techniques.
This vulnerability maps directly to CWE-352, which describes Cross-Site Request Forgery (CSRF), as the application fails to verify that a state-changing request was intentionally initiated by the user. Furthermore, it aligns with MITRE ATT&CK technique T1078, Valid Accounts, because the exploitation relies on leveraging existing valid credentials and session states of legitimate users rather than breaking authentication mechanisms directly. The impact is particularly severe in enterprise environments where Frappe is used for business process management, as unauthorized workflow approvals can lead to incorrect financial transactions, improper resource allocation, or bypassing critical compliance checks embedded within approval chains.
Mitigation strategies must focus on enforcing strict HTTP method validation at the framework level and implementing robust anti-CSRF protections. Developers should immediately patch their instances by modifying the bulk_workflow_approval endpoint definition in frappe/model/workflow.py to explicitly restrict access to POST requests only, ensuring that GET or other safe methods are rejected with a 405 Method Not Allowed response. Additionally, integrating CSRF tokens into all state-changing forms and API endpoints is essential to verify the origin of each request. Until an official fixed version is released by the Frappe team, organizations should consider implementing reverse proxy rules to block non-POST requests targeting this specific endpoint or disabling bulk workflow approval functionality entirely if it is not strictly required for business operations.