CVE-2026-41317: Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).press.api.account.createapisecret is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41317?
CVE-2026-41317 has a high severity rating due to the risk of unauthorized API secret generation through CSRF-like exploits.
How do I fix CVE-2026-41317?
To fix CVE-2026-41317, ensure that proper CSRF protections are implemented for the API endpoint `press.api.account.create_api_secret`.
What are the potential impacts of CVE-2026-41317?
The potential impacts of CVE-2026-41317 include unauthorized access to user accounts and API keys due to insecure HTTP method handling.
Is CVE-2026-41317 a concern for all users of Frappe Press?
Yes, CVE-2026-41317 is a concern for all users of Frappe Press, as it affects the security of the application across all deployments.
What versions of Frappe Press are affected by CVE-2026-41317?
CVE-2026-41317 affects all versions of Frappe Press that do not include the patch for this vulnerability.