In versions of the Frappe framework up to 16.31.0 the endpoint frappe.model.workflow.bulk_workflow_approval accepts safe HTTP methods (GET, HEAD, OPTIONS, TRACE) for actions that normally should only be performed with POST. This design flaw allows an attacker to generate a request that a victim’s authenticated browser will submit, resulting in an approval of a workflow without the victim’s intention or consent. The vulnerability is a cross‑site request forgery that elevates the attacker’s privilege to that of the victim, potentially allowing unauthorized alteration of business processes. The weakness is captured by CWE‑352.

The affected product is the Frappe web application framework, version 16.31.0 and earlier. No fixed version has been released at the time of this review. Users of newer releases are not impacted, and a vendor fix is expected in a future update.

The CVSS score of 6.9 reflects a moderate risk profile; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker cannot directly trigger the approval but can lure a logged‑in user into submitting a request exposed to the vulnerable endpoint, typically through a phishing link or malicious script. If successful, the victim’s privileges are abused to approve a workflow, which may trigger downstream actions with business or security implications. The overall threat is moderate and depends on the attacker’s ability to compromise user interactions.