CVE-2026-41317: CWE-352: Cross-Site Request Forgery (CSRF) in frappe press
CVE-2026-41317 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Frappe custom app 'press', which manages infrastructure and SaaS on Frappe Cloud. The vulnerable endpoint 'press. api. account. create_api_secret' allows database writes and is accessible via the GET method, enabling CSRF-like exploits. A patch has been committed that restricts this endpoint to POST requests only, mitigating the vulnerability.
AI Analysis
Technical Summary
The vulnerability in Frappe's 'press' app involves the 'press.api.account.create_api_secret' endpoint, which improperly allows state-changing operations via the GET HTTP method. This design flaw enables CSRF attacks because GET requests can be triggered by third-party sites without user interaction. The issue is addressed by a patch that restricts the endpoint to accept only POST requests, thereby reducing the risk of unauthorized actions.
Potential Impact
An attacker could exploit this vulnerability to perform unauthorized actions that modify the database via the vulnerable endpoint without user consent. This could lead to unauthorized creation of API secrets, potentially compromising account security or system integrity. The CVSS 4.0 score of 6.6 reflects a medium severity impact with network attack vector, no privileges or user interaction required, and high impact on integrity.
Mitigation Recommendations
A patch is available as indicated by the commit restricting the vulnerable endpoint to POST requests. Users should update to the version including commit 52ea2f2d1b587be0807557e96f025f47897d00fd or later to remediate this vulnerability. Until patched, avoid exposing the vulnerable endpoint to untrusted environments or implement additional CSRF protections.
CVE-2026-41317: CWE-352: Cross-Site Request Forgery (CSRF) in frappe press
Description
CVE-2026-41317 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Frappe custom app 'press', which manages infrastructure and SaaS on Frappe Cloud. The vulnerable endpoint 'press. api. account. create_api_secret' allows database writes and is accessible via the GET method, enabling CSRF-like exploits. A patch has been committed that restricts this endpoint to POST requests only, mitigating the vulnerability.
CVSS v4.0
Score 6.6medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Frappe's 'press' app involves the 'press.api.account.create_api_secret' endpoint, which improperly allows state-changing operations via the GET HTTP method. This design flaw enables CSRF attacks because GET requests can be triggered by third-party sites without user interaction. The issue is addressed by a patch that restricts the endpoint to accept only POST requests, thereby reducing the risk of unauthorized actions.
Potential Impact
An attacker could exploit this vulnerability to perform unauthorized actions that modify the database via the vulnerable endpoint without user consent. This could lead to unauthorized creation of API secrets, potentially compromising account security or system integrity. The CVSS 4.0 score of 6.6 reflects a medium severity impact with network attack vector, no privileges or user interaction required, and high impact on integrity.
Mitigation Recommendations
A patch is available as indicated by the commit restricting the vulnerable endpoint to POST requests. Users should update to the version including commit 52ea2f2d1b587be0807557e96f025f47897d00fd or later to remediate this vulnerability. Until patched, avoid exposing the vulnerable endpoint to untrusted environments or implement additional CSRF protections.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-20T14:01:46.671Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69eada9887115cfb68a5e99f
Added to database: 4/24/2026, 2:51:04 AM
Last enriched: 5/1/2026, 8:50:09 PM
Last updated: 6/8/2026, 7:06:47 AM
Views: 111
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.