CVE-2026-63654

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in workflow.py. An attacker can execute arbitrary code, cause denial of service, disclose sensitive information, or tamper with data by providing specially crafted serialized input. Details Serializatio...