The Frappe 'press' app, which manages infrastructure and SaaS services, contains a CSRF vulnerability in the 'create_api_secret' API endpoint. This endpoint improperly accepts GET requests that perform database writes, exposing it to CSRF attacks. The vulnerability is identified as CWE-352. The issue is addressed by a patch that restricts the endpoint to POST requests, preventing exploitation via CSRF. The vulnerability has a CVSS 4.0 base score of 6.6, indicating medium severity. No known exploits are reported in the wild. The patch is referenced by a specific commit ID, but no formal vendor advisory or patch link is provided.

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized actions that write to the database via the vulnerable API endpoint without user interaction. This could lead to unauthorized creation or modification of API secrets within the 'press' application. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known active exploits have been reported.

A patch is available that restricts the vulnerable endpoint to accept only POST requests, effectively mitigating the CSRF risk. Users should update to the version including commit 52ea2f2d1b587be0807557e96f025f47897d00fd or later. Since no official vendor advisory or patch link is provided, users should verify the patch status with the Frappe project repository or official channels. Until patched, avoid exposing the vulnerable endpoint to untrusted networks or implement CSRF protections such as anti-CSRF tokens.