CVE-2026-63654

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63654", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-17T14:47:08.031Z", "datePublished": "2026-08-20T18:23:52.994Z", "dateUpdated": "2026-08-20T19:47:38.338Z"}, "containers": {"cna": {"title": "Frappe: Unauthenticated Workflow approval via confirm_action", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm"}, {"name": "https://github.com/frappe/frappe/pull/41361", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/frappe/pull/41361"}, {"name": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f"}], "affected": [{"vendor": "frappe", "product": "frappe", "versions": [{"version": "<= 16.31.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:23:52.994Z"}, "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."}], "source": {"advisory": "GHSA-cgwf-xgph-hxgm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:47:26.907767Z", "id": "CVE-2026-63654", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:47:38.338Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63654", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:47:26.907767Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:47:34.520Z"}}], "cna": {"title": "Frappe: Unauthenticated Workflow approval via confirm_action", "source": {"advisory": "GHSA-cgwf-xgph-hxgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "frappe", "product": "frappe", "versions": [{"status": "affected", "version": "<= 16.31.0"}]}], "references": [{"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm", "name": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frappe/frappe/pull/41361", "name": "https://github.com/frappe/frappe/pull/41361", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f", "name": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:23:52.994Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63654", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:47:38.338Z", "dateReserved": "2026-07-17T14:47:08.031Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T18:23:52.994Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "frappe", "vendor": "frappe", "versions": [{"status": "affected", "version": "<= 16.31.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review."}, {"lang": "es", "value": "Frappe es un framework de aplicaci\u00f3n web full-stack. En la versi\u00f3n 16.31.0 y anteriores, el endpoint frappe.model.workflow.bulk_workflow_approval, incluido en la lista blanca, en frappe/model/workflow.py acepta m\u00e9todos HTTP seguros para aprobaciones de flujo de trabajo que cambian de estado porque el endpoint no est\u00e1 restringido a POST. Un atacante puede inducir a un navegador de la v\u00edctima autenticado a enviar una acci\u00f3n de aprobaci\u00f3n con los privilegios de la v\u00edctima. No hay ninguna versi\u00f3n corregida publicada disponible a partir de esta revisi\u00f3n."}], "id": "CVE-2026-63654", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63654", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:47:26.907767Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:16:57.570", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f"}, {"source": "security-advisories@github.com", "url": "https://github.com/frappe/frappe/pull/41361"}, {"source": "security-advisories@github.com", "url": "https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,16.31.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "frappe", "source": "cna", "vendor": "frappe"}, "product": "frappe", "vendor": "frappe"}], "created": "2026-08-20T19:30:05.140194+00:00", "updated": "2026-08-21T01:45:08.038951+00:00", "vendors": ["frappe", "frappe$PRODUCT$frappe"]}