CVE-2026-63654
Received Received - Intake

Bulk Workflow Approval State Change in Frappe

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63654
EUVD
EUVD-2026-63538

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
frappe frappe 16.31.0
frappe frappe 15
frappe frappe to 16.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63654 is a vulnerability in the Frappe framework where the whitelisted bulk workflow approval endpoint accepts safe HTTP methods like GET for state-changing workflow approvals. This allows an attacker to trick an authenticated user into submitting an approval action with the victim's privileges without proper authentication.

Detection Guidance

Check Frappe application logs for unusual GET requests to endpoints like /api/method/frappe.model.workflow.bulk_workflow_approval. Monitor network traffic for HTTP GET requests to whitelisted endpoints that should only accept POST. Review server access logs for repeated failed POST attempts to these endpoints.

Impact Analysis

An attacker could exploit this to perform unauthorized workflow approvals or document updates on behalf of authenticated users. This could lead to unintended changes in system state, data corruption, or unauthorized access to sensitive operations within the Frappe application.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive data, potentially violating compliance requirements under GDPR (data integrity) and HIPAA (unauthorized access to protected health information). Unauthorized workflow approvals may also breach audit and accountability controls.

Mitigation Strategies

Update Frappe to the latest patched version immediately. If updating is not possible, restrict access to the vulnerable endpoints at the web server level to block GET requests. Ensure all workflow approval actions are performed only via authenticated POST requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart