CVE-2026-41317 Details
Description
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS).`press.api.account.create_api_secret` is prone to CSRF-like exploits. This endpoint writes to database and it is also accessible via GET method. The patch in commit 52ea2f2d1b587be0807557e96f025f47897d00fd restricts method to POST.
A vulnerability allowing CSRF-like exploits has been identified in the `create_api_secret` endpoint of the Frappe Press custom application, which manages various aspects of Frappe Cloud. This endpoint, accessible via the GET method, writes to the database and is susceptible to Cross-Site Request Forgery (CSRF) attacks. The issue arises because the endpoint was not properly restricted to a safer HTTP method, allowing potential exploitation.
Users can update to version 52ea2f2d1b587be0807557e96f025f47897d00fd, where this vulnerability has been patched by restricting the `create_api_secret` endpoint to the POST method.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| frappe press | < 0.9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | [email protected] |