Frappe Cloud/ERPNext CVE-2026-4894

Exploitation requires that the target expose the Frappe Cloud/ERPNext self-service registration endpoint /api/method/press.api.account.signup to the attacker (the default for Frappe Cloud's public signup and any ERPNext deployment with open registration). The concrete prerequisite is the ability to submit a signup request whose email field contains more than one address, at least one of which is valid/attacker-controlled; the server then processes the entire value as a recipient list. No authentication, user interaction, or non-default configuration is needed (PR:N/UI:N). The primary LIMITING factor is deployment exposure: installations that disable open/self-service signup, restrict registration to invited or SSO users, or front the endpoint with validation/WAF controls are not reachable, and impact is bounded to the registration/OTP flow rather than existing account compromise.

This is a moderate-severity authentication-design flaw (CWE-290) rated 6.9 via CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with only Low confidentiality and Low integrity impact (VC:L/VI:L) and no availability impact. The vector signals favor exploitation - network-reachable, low complexity, no authentication, no user interaction - meaning any remote attacker can hit the /api/method/press.api.account.signup endpoint directly. However, the real-world severity is tempered by the limited impact: the flaw enables OTP interception for the signup/registration flow and email-existence enumeration, not direct takeover of existing provisioned accounts or data exfiltration. No EPSS score, KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified from probabilistic signals and there is no public exploit identified at time of analysis. The CVSS vector (unauthenticated network) is internally consistent with the description ('unauthenticated remote attacker'), so there is no AV conflict to flag. Net assessment: a legitimate account-integrity/impersonation issue worth patching on exposed Frappe Cloud/ERPNext signup surfaces, but not an emergency 'drop everything' flaw absent evidence of active exploitation - treat as medium priority weighted by how exposed the registration endpoint is.

An unauthenticated attacker sends a signup request to /api/method/press.api.account.signup with the email field manipulated to contain multiple addresses (e.g. the victim's real address plus an attacker-controlled one), where only one needs to be valid. The service treats the whole value as a recipient list and delivers the OTP to all addresses, letting the attacker capture the code and complete registration while impersonating the victim's email, or confirm whether a given email is already registered. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means the crafted request requires no special timing or preconditions.