CVE-2026-109598 in Frappe
Summary
by MITRE • 10/13/2026
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The Frappe Framework, a popular open-source full-stack web framework used for building business applications such as ERPNext and custom enterprise solutions, contains a critical access control flaw in its messaging subsystem. Specifically, versions prior to 15.120.0 and the 16.x series before version 16.33.0 exhibit a missing authorization vulnerability within the whitelisted send_sms API endpoint. This architectural oversight allows any authenticated user with minimal privileges to invoke this function without verifying whether they possess the specific permissions required for SMS transmission. In secure application design, endpoints that perform sensitive actions like sending external communications must enforce strict role-based access control checks before executing logic. The absence of these checks in Frappe represents a fundamental failure in implementing proper authorization mechanisms, leaving the integrity and confidentiality of organizational communication channels compromised.
From a technical perspective, this vulnerability stems from the framework's whitelisting mechanism which grants broad execution rights to specific functions without adequate granular permission validation at runtime. When an authenticated user calls the send_sms endpoint, the system processes the request based solely on their authentication status rather than verifying their authorization level against predefined security policies. This allows attackers who have obtained valid credentials for low-privilege accounts to bypass intended restrictions and execute administrative-level actions. The flaw is particularly dangerous because SMS messages are often perceived as trusted channels by recipients; therefore, an attacker can leverage this capability to send phishing links, malicious payloads, or fraudulent instructions that appear to originate from the legitimate company infrastructure. This undermines trust in corporate communications and facilitates social engineering attacks with high success rates due to the inherent credibility of text-based messaging platforms.
The operational impact of this vulnerability is severe for organizations relying on Frappe for customer engagement, internal notifications, or transactional alerts. An attacker can exploit this flaw to send arbitrary SMS messages that impersonate the company, leading to potential financial fraud through business email compromise-style attacks adapted for mobile channels. Victims receiving these fraudulent messages may be tricked into revealing sensitive information such as passwords, credit card numbers, or one-time passcodes. Furthermore, the abuse of organizational resources can result in significant reputational damage and regulatory scrutiny if customer data is mishandled during the attack chain. The ability to send unsolicited bulk messages also poses risks related to spam regulations and carrier blocking, which could disrupt legitimate business operations by causing company phone numbers or short codes to be flagged as malicious sources.
To mitigate this risk, organizations running affected versions of Frappe must upgrade immediately to version 15.120.0 or later for the v15 branch, or version 16.33.0 and above for the v16 branch where these authorization checks have been properly implemented. Until an upgrade is feasible, administrators should consider implementing network-level controls such as web application firewalls to restrict access to the send_sms endpoint exclusively from trusted internal IP ranges if external API calls are not required. Additionally, reviewing user roles and permissions within the Frappe console can help identify accounts with excessive privileges that could be leveraged for this attack vector. Security teams should also monitor logs for unusual spikes in SMS sending activity originating from low-privilege users as an indicator of compromise. This vulnerability is classified under CWE-285 Improper Authorization, highlighting the critical need for rigorous access control verification in all API endpoints exposed to authenticated users. It aligns with MITRE ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to perform unauthorized actions within a system environment.