CVE-2026-109598mediumCWE-862

CVE-2026-109598: fallo de gravedad media en frappe

Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Publicada el · Actualizada el

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
frappe · frappe
CVEs relacionadas — frappe

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-46127MEDIUMFrappe vulnerable to HTML injection by any Desk userEPSS 37.0%CVE-2026-39352HIGHFrappe has an Arbitrary File Read via Path Traversal in render_includeEPSS 1.3%CVE-2022-23055—ERPNext - Improper user access conrolEPSS 1.2%CVE-2022-23058—ERPNext - Stored XSS in My SettingsEPSS 0.9%CVE-2026-66002MEDIUMFrappe: User Enumeration via PDDREPSS 0.8%CVE-2025-30213MEDIUMFrappe has Possibility of Remote Code Execution due to improper validationEPSS 0.7%
Referencias
https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvqhttps://www.vulncheck.com/advisories/frappe-before-16.33.0-broken-authorization-via-send-sms-endpoint