CVE-2026-66001

Frappe , a full-stack web application framework, contains an improper authorization flaw in its OAuth2 consent flow (frappe/integrations/oauth2.py). The approve and authorize functions lacked three critical controls: the approve action was not restricted to POST , the consent template (oauth_conf...