Authorization Bypass in Frappe Framework via Jinja Template Rendering

Executive Summary

CVE-2026-82634 is an authorization flaw in the Frappe Framework development builds. It allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings via the render_jinja_template endpoint. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.

Useful 0 Not Useful 0

Detection Guidance

Check Frappe Framework versions between >= 0a80046da32bb8976cd7854f551c179a4a06b1b3 and < 37d2eb59790633da01c741b950cc00ca3558c494. Inspect logs for unauthorized Jinja template rendering attempts via the render_jinja_template endpoint. Look for print permission misuse on documents leading to SELECT statement execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access sensitive data such as password hashes from the __Auth table. Attackers could extract confidential information, manipulate database queries, or gain elevated privileges by exploiting this flaw.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance, legal penalties, and reputational damage due to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a patched version of Frappe Framework (>= 37d2eb59790633da01c741b950cc00ca3558c494). Restrict access to the render_jinja_template endpoint by ensuring only users with Sys.Man role can use it. Review and revoke unnecessary print permissions on documents to prevent unauthorized SELECT queries.

Useful 0 Not Useful 0