CVE-2026-41317

MEDIUM

Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation

Title source: cna

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.

References (2)

[X_Refsource_Confirm] https://github.com/frappe/press/security/advisories/GHSA-q4wg-jrr8-vpwf

[X_Refsource_Misc] https://github.com/frappe/press/commit/52ea2f2d1b587be0807557e96f025f47897d00fd

View Writeup ZIP pw:eip

Scores

CVSS v4 6.6

EPSS 0.0002

EPSS Percentile 5.1%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Details

CWE

CWE-352

Status published

Products (1)

frappe/press < 52ea2f2d1b587be0807557e96f025f47897d00fd

Published Apr 24, 2026

Tracked Since Apr 24, 2026