CVE-2026-63654: Frappe: Unauthenticated Workflow approval via confirm_action
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the endpoint to reject all non-POST HTTP methods for state-changing workflow approvals so that only POST can invoke bulk_workflow_approval.
Frappe (frappe.model.workflow.bulk_workflow_approval endpoint, frappe/model/workflow.py) HTTP method restriction = Restrict to POST only (disable/deny other safe HTTP methods such as GET/HEAD/OPTIONS)
Event History
Frequently Asked Questions
Which users are exposed to a successful attack?
Authenticated users whose privileges allow them to approve the relevant workflow actions are exposed. The approval is performed with the victim's existing privileges.
What does an attacker need to do to exploit this issue?
The attacker must induce an authenticated victim's browser to submit an approval action. The issue relies on the victim being logged in and able to approve the workflow action.
Is a released fix available?
No released fixed version was available as of this review. Versions 16.31.0 and earlier are identified as affected.