Frappe Framework Missing Authorization in send_sms API

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109598

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0
frappe	frappe	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe Framework versions before 15.120.0 and 16.x before 16.33.0 have a missing authorization vulnerability in the whitelisted send_sms API endpoint. The issue is that the endpoint does not verify if the caller has permission to send SMS messages, allowing unauthorized users to send arbitrary SMS messages while impersonating the company.

Impact Analysis

This vulnerability allows unauthorized users to send SMS messages that appear to come from your company. This could lead to phishing attacks, misinformation spread, or reputational damage if the messages are malicious or fraudulent.

Mitigation Strategies

Update Frappe Framework to version 15.120.0 or later if using 15.x, or to 16.33.0 or later if using 16.x. Ensure proper authorization checks are enforced for the send_sms API endpoint to prevent unauthorized SMS message sending.

Hi! I’m here to help you understand CVE-2026-109598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70