Frappe is a full‑stack web application framework. The approve and authorize functions in the OAuth2 consent flow are vulnerable because they allow approval without restricting to POST, lack a CSRF token, and do not restrict token checks to the requesting client. This constitutes a Cross‑Site Request Forgery weakness (CWE-352) and results in an attacker being able to trick an authenticated user into approving an OAuth grant or reuse authorization state for a different client, exposing user data and permitting actions within the granted scopes.

All installations of the Frappe framework running version 15.x prior to v15.114.0 and version 16.x prior to v16.26.0 are affected. Any instance using these releases must be addressed.

Based on the description, it is inferred that the likely attack vector is a web-based request to the OAuth2 consent endpoint from a malicious site or phishing page. The vulnerability has a CVSS score of 8.5, indicating high severity. Its exploitation requires a web-based attack that targets the OAuth2 consent endpoint and an authenticated user. Because the approve function is not limited to POST and lacks CSRF protection, an attacker can craft a request that a user unknowingly submits, causing the grant to be approved. The OAuth token is not scoped to the requesting client, so the attacker can also reuse the authorization state for a malicious client. No KEV listing and an unavailable EPSS score makes the likelihood of exploitation unclear, but the high CVSS suggests a significant risk if the flaw is discovered. Prompt remediation is recommended.