CVE-2026-41317
Awaiting Analysis Awaiting Analysis - Queue
BaseFortify

Publication date: 2026-04-24

Last updated on: 2026-04-30

Assigner: GitHub, Inc.

Description
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-24
Last Modified
2026-04-30
Generated
2026-05-07
EPSS Evaluated
2026-05-05
NVD
CVE-2026-41317
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
frappe press to 0.9.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart