Frappe Framework CVE-2026-109598

Requires a valid authenticated Frappe session for any low-privilege user account (PR:L) that lacks SMS-sending permissions; the attacker then calls the whitelisted send_sms endpoint, which omits the authorization check. Practical impact is further gated by whether the instance has a functioning SMS gateway configured - without it, calls may not deliver messages. Limiting factors: authentication is required (not fully anonymous), no user interaction is needed, and impact is confined to integrity/impersonation of outbound SMS with no data disclosure or service disruption.

This is a genuinely medium/low-priority issue, not a high-severity emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 and is internally consistent with CWE-862 (Missing Authorization) and the description: a network-reachable but *authenticated* low-privilege user (PR:L) can call the endpoint, with the only impact being low integrity (VI:L) - SMS messages that impersonate the Company - and no confidentiality or availability impact. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are coherent rather than conflicting: a low-privilege-required authorization gap with limited integrity-only impact. The main real-world risk is abuse for SMS-based phishing/social engineering or SMS-cost abuse rather than system compromise. Note the input tag 'Authentication Bypass' is a mild mischaracterization - this is a missing *authorization* (broken access control) flaw affecting already-authenticated users, not an authentication bypass.

A low-privileged but authenticated Frappe user (for example a basic employee or self-service portal account) calls the whitelisted send_sms API endpoint, which fails to check SMS-sending permissions. They send arbitrary SMS messages that appear to originate from the Company, enabling phishing, fraud, or reputational abuse. No public exploit code was provided in the input, so exploitation would require crafting the API call manually.