CVE-2026-66001: Frappe: Improper Authorization in OAuth2 Consent Endpoint
Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in frappe/templates/includes/oauthconfirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.114.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.26.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Frappe deployments running versions earlier than 15.114.0 or 16.26.0 are affected. Exploitation requires an authenticated user participating in an OAuth2 consent flow.
What does an attacker need to do to exploit it?
An attacker can induce an authenticated user to approve an OAuth grant because approval is not restricted to POST and the confirmation page lacks a CSRF token. The attacker may also reuse authorization state for a different OAuth client because active-token validation is not scoped to the requesting client.
What is the impact of a successful exploit?
A successful attack can grant OAuth access without the user intentionally approving it for the intended client. This can expose data and allow actions covered by the granted OAuth scopes.
What should be done if patching is not immediately possible?
The provided information does not specify a workaround. Updating to Frappe 15.114.0 or 16.26.0 is the documented fix.