What’s Vulnerable › Vulnerabilities

CVE-2026-41317: Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-10-26
• Weakness: CWE-352

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.

Affected products

• frappe press: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: frappe press 0.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/frappe/press/commit/52ea2f2d1b587be0807557e96f025f47897d00fd
• https://github.com/frappe/press/security/advisories/GHSA-q4wg-jrr8-vpwf

Get alerted when CVE-2026-41317 or the next vulnerability affects your stack