---
id: CVE-2026-63654
title: Frappe is a full-stack web application framework
summary: >-
  Frappe is a full-stack web application framework. In version 16.31.0 and
  earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint
  in frappe/model/workflow.py accepts safe HTTP methods for state-changing
  workflow app…
severity: none
cwe:
  - CWE-352
published: '2026-08-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:48:30.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63654'
references:
  - url: >-
      https://github.com/frappe/frappe/commit/8465376ad9f81775c20892338f920c695b88fb1f
    label: security-advisories@github.com
  - url: 'https://github.com/frappe/frappe/pull/41361'
    label: security-advisories@github.com
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-cgwf-xgph-hxgm'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00256
epssPercentile: 0.15393
ingestedAt: '2026-09-10T21:05:53.597Z'
---

## Overview

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.