CVE-2026-66001 frappe CVE debrief

Who should care

Defenders responsible for Frappe deployments, particularly those using OAuth2 for authorization, should assess exposure and verify configurations. They must prioritize verifying OAuth2 client configurations, ensuring proper authorization state management, and monitoring for suspicious authorization requests.

Why it matters

The CVE-2026-66001 vulnerability in Frappe allows an attacker to manipulate OAuth2 authorization, exposing data and permitting actions within granted scopes. Defenders should prioritize verifying configurations, ensuring proper authorization state management, and monitoring for suspicious requests.

• An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes.
• Defenders must verify OAuth2 client configurations to prevent unauthorized access.
• Proper authorization state management is crucial to prevent exploitation.

Technical summary

The approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. This issue is fixed in versions 15.114.0 and 16.26.0. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes.

Defensive priority

Defenders should prioritize verifying OAuth2 client configurations, ensuring proper authorization state management, and monitoring for suspicious authorization requests.

Recommended defensive actions

• Verify OAuth2 client configurations and authorization state management
• Monitor for suspicious authorization requests
• Ensure proper scoping of OAuth tokens
• Update to versions 15.114.0 or 16.26.0
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected versions is limited. The approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. Defenders should verify OAuth2 client configurations to prevent unauthorized access and ensure proper

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.