PT-2026-111017

CVE-2026-109598

Published

2026-10-12

Updated

2026-10-13

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 15.120.0 Frappe Framework versions 16.x prior to 16.33.0

Description An authorization flaw exists in the whitelisted 'send sms' API endpoint. The system fails to verify if the caller has the necessary permissions to send SMS messages, allowing unauthorized users to send arbitrary messages that impersonate the company.

Recommendations Update to version 15.120.0 or later. Update to version 16.33.0 or later. Restrict access to the 'send sms' API endpoint to authorized users only.

Exploitability

Exploit

Fix

Impacts

Researchers

Aardg10

Darshan060224

Kartiks914

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization