Status of CVE-2025-28062

Install / Update Security
1

https://www.cvedetails.com/cve/CVE-2025-28062/

https://www.cve.org/CVERecord?id=CVE-2025-28062

I saw this CVE reported against ERPNext, but could not find a response or update. Has this been fixed? This was reported on 05/05/2025.

Seems to be a high risk exploit.

2

Agree with you, in case if its really compromising!

3

To paraphrase, the issue was that you could click on some malicious link that makes you trigger an API call to ERPNext that potentially modifies some entries. Clicking on a link corresponds to a GET request. This issue has been addressed by restricting some of frappe frameworks’ core API endpoints to non-GET requests:

If you find any other whitelisted methods that allow modifying data through a GET request, please report them as a vulnerability to Security (or the corresponding custom app provider).

2 Likes
4

Thanks for the update. I can see the github issue and commits. But the CVE is still not closed and probably because the github issue doesn’t reference the CVE number. Could someone from Frappe mark that CVE as closed with reference to this github issue? (like how all other CVEs have been closed…)

5

A CVE record never flips to a “closed” or “resolved” state the way a ticket in a bug-tracker does. Once published it stays on the public list forever. The only three official CVE states are RESERVED → PUBLISHED → REJECTED.

I’ve submitted a request via https://cveform.mitre.org/ to include info about the fixed versions.

6

Thanks @rmeyer
I’m also wondering why this CVE is not listed in Frappe’s security advisory page - Security Advisories · frappe/frappe

Any idea?

7

@kirthi, appriciated :clap: for highlighting this issue as “security is one of our main concerns!”

8

Frappe team has now added the CVE to the advisory - Account takeover via CSRF ¡ Advisory ¡ frappe/frappe ¡ GitHub

Thanks.