Description
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.
Published: 2026-04-24
Score: 6.6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 24 Apr 2026 02:45:00 +0000

Type Values Removed Values Added
Description Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.
Title Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
Weaknesses CWE-352
References
Metrics cvssV4_0

{'score': 6.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-24T02:40:16.528Z

Reserved: 2026-04-20T14:01:46.671Z

Link: CVE-2026-41317

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-24T03:16:12.113

Modified: 2026-04-24T03:16:12.113

Link: CVE-2026-41317

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses