CVE-2026-82634

Name of the Vulnerable Software and Affected Versions Frappe Framework development builds (affected versions not specified)

Description An authorization flaw exists in the '/render jinja template' endpoint. Low-privileged users can render arbitrary Jinja templates by providing raw template strings. This allows attackers who possess print permissions on any document to execute arbitrary SELECT statements against unrelated tables, which can lead to the exposure of password hashes from the Auth table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.