CVE-2026-115718 in Builder
Summary
by MITRE • 10/26/2026
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Frappe Builder versions prior to 1.36.0 represents a critical failure in access control mechanisms within the application's backend logic. Specifically, the flaw resides in the improve_prompt endpoint, which is designed to facilitate interactions with Large Language Models by refining user inputs through automated completion services. In these affected versions, the system fails to enforce proper authorization checks for this specific API route. Consequently, any authenticated session that does not hold the Guest role can invoke this functionality without verifying whether the user has explicit permission to access LLM-related features or consume associated resources. This absence of a mandatory access control check allows unauthorized users to bypass intended restrictions and interact directly with the underlying AI infrastructure.
The operational impact of this vulnerability is significant, primarily due to its potential for financial exploitation and resource abuse. When an attacker invokes the improve_prompt endpoint, the application utilizes the resolve_api_key function to retrieve the site owner's stored OpenRouter API key from the database or configuration store. This action effectively allows the attacker to leverage the legitimate credentials of the system administrator to send requests to external Large Language Model providers. Since these services operate on a pay-per-use model based on token consumption, every unauthorized call results in direct financial loss for the site owner. The vulnerability essentially transforms the compromised Frappe Builder instance into an open proxy for AI inference services, enabling attackers to consume paid LLM credits at will without detection or restriction from the application's native permission system.
From a technical classification perspective, this issue aligns with CWE-269, which denotes Improper Privilege Control, as it involves a user possessing lower privileges than required to perform an action on a specific resource. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1588.003, specifically under the subcategory of Obtain Credentials: Cloud Account Access Token. By abusing the application's internal logic to extract and utilize stored API keys for unauthorized purposes, attackers are effectively stealing cloud account access tokens or credentials embedded within the application environment. This behavior also reflects aspects of CWE-798, which covers Use of Hardcoded Credentials, although in this context, the credential is dynamically retrieved rather than statically coded, yet still represents an improper handling of sensitive authentication material due to lack of authorization checks.
To mitigate this vulnerability and prevent further exploitation, immediate action must be taken by upgrading Frappe Builder to version 1.36.0 or later, where the missing authorization check has been addressed in the codebase. For environments that cannot immediately upgrade, administrators should implement a reverse proxy rule or WAF policy to restrict access to the improve_prompt endpoint exclusively for users with explicit administrative privileges. Additionally it is crucial to rotate the OpenRouter API key associated with the affected instance to invalidate any tokens potentially harvested by attackers during the window of exposure. Implementing strict rate limiting on LLM-related endpoints can also help mitigate potential abuse and reduce financial impact if unauthorized access persists before full remediation occurs.