CyberRota Analysis
AI-GeneratedThe vulnerability affects the Frappe web application framework, specifically the bulk_workflow_approval endpoint, which improperly allows state-changing actions through safe HTTP methods beyond just POST. This flaw enables an attacker to trick an authenticated user into executing approval actions with their privileges, potentially leading to unauthorized changes in workflows. Organizations using Frappe, particularly those with version 16.31.0 or earlier, should prioritize addressing this issue to mitigate the risk of privilege escalation attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.