Cross-Site Request Forgery Vulnerability in Frappe Cloud Product

CVE-2026-41317

What is CVE-2026-41317?

The Press app, a custom application running on Frappe Cloud, suffers from a significant vulnerability that exposes the press.api.account.create_api_secret endpoint to potential CSRF-like attacks. This critical endpoint, which is responsible for creating API secrets, can be accessed using the GET method, allowing unauthorized requests to be executed that may write to the database. A security patch has been introduced to mitigate this risk by restricting access to the endpoint to POST requests only. This change aims to enhance the security posture of the application by preventing misuse that could lead to unauthorized modifications.

References