CVE-2026-63654 is a CSRF vulnerability in Frappe's bulk workflow approval endpoint that accepts GET requests for state-changing operations. In isolation, this would be a routine medium-severity finding. What makes this different is the absence of a vendor patch — organizations cannot fix this by upgrading, which fundamentally breaks the risk calculation that CVSS and EPSS assume.
The bulk approval dimension is the critical amplifier. One authenticated browser visit can approve dozens of workflow transitions simultaneously, not just a single document. This isn't theoretical convenience — it's architectural design that treats bulk approval as an optimization feature. The permission boundary matters here: the blast radius depends entirely on what workflow-enabled doctypes the victim has approval rights over. A user with broad approval authority could silently approve across finance, procurement, and HR workflows in a single request.
More concerning is the downstream chaining. In Frappe deployments, approved documents don't sit idle — they trigger automated processes. An approved Purchase Order submits to accounting. An approved Expense Report triggers reimbursement. An approved Leave Application notifies payroll. One CSRF-rigged visit doesn't just mark documents approved; it detonates whatever automation chain those approvals gate.
The EPSS score will be cited to deprioritize this — it's modeled on a world where patches exist. When they don't, the scoring flips: exploitation becomes a question of when your specific deployment gets scanned by someone who already knows this vector exists, not whether global threat actors will find it. The vulnerability is now public knowledge with no remediation path — an unconditional attack surface for any Frappe instance.
Compensating controls are the only option. Restrict the approval endpoint to POST-only at the WAF or application layer. Audit which doctypes have approval workflows with downstream automation — that's where the real exposure lives. The organizations most vulnerable are those with extensive workflow automation who assume the medium CVSS rating reflects manageable risk. It doesn't.