CVE-2026-109598Medium· 4.3▾ SunlitFrappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109599Medium· 4.3Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks
CVE-2026-109600Medium· 5.3Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications
CVE-2026-119145Critical· 9.9Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
CVE-2026-119144High· 8.8Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt