CVE-2026-63654— Frappe: Unauthenticated Workflow approval via confirm_action
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 是一个全栈 Web 应用框架。在 16.31.0 及更早版本中， 文件中受白名单保护的 端点因未限制仅允许 POST 方法，而接受其他安全的 HTTP 方法来执行改变工作流状态的操作。攻击者可以诱使已认证的受害者浏览器以受害者的权限提交审批操作。截至本次审查时，尚未发布任何修复该问题的版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe: Unauthenticated Workflow approval via confirm_action
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-63654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63654
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63654 (2)
Vendor Advisories for CVE-2026-63654 (1)
-
🔗 Unauthenticated Workflow approval · Advisory · frappe/frappe · GitHub x_refsource_CONFIRM
Same Patch Batch · frappe · 2026-08-20 · 5 CVEs total
| CVE-2026-66001 | 8.5 HIGH | Frappe: Improper Authorization in OAuth2 Consent Endpoint |
| CVE-2026-62315 | 7.1 HIGH | Frappe: Mass assignment via set_value |
| CVE-2026-66002 | 6.9 MEDIUM | Frappe: User Enumeration via PDDR |
| CVE-2026-53569 | 5.3 MEDIUM | Frappe: Missing authorization in toggle_like and mark_as_seen |
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-66002
Frappe: User Enumeration via PDDR -
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see -
CVE-2026-66000
Frappe: Unrestricted access to Document Follow APIs
Same vendor: frappe
-
CVE-2026-66002
Frappe: User Enumeration via PDDR -
CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint -
CVE-2026-62315
Frappe: Mass assignment via set_value -
CVE-2026-53569
Frappe: Missing authorization in toggle_like and mark_as_see -
CVE-2026-65822
ERPNext: SQL Injection in "Inactive Customers" report via un
Same weakness: CWE-352
-
CVE-2026-78280
WordPress Hash Form plugin <= 1.4.0 - Cross Site Request For -
CVE-2026-78279
WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Re -
CVE-2026-58003
WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.j -
CVE-2026-58001
WWBN AVideo Cross-Site Request Forgery via videoEditLight.ph -
CVE-2026-57944
AVideo channelToGallery.json.php Cross-Site Request Forgery
V. Comments for CVE-2026-63654
No comments yet