Frappe Builder EUVD-2026-109780

Three concrete prerequisites must all hold: (1) the site runs a vulnerable Frappe Builder version in the band 1.33.0 through 1.35.x; (2) an AI provider key (OpenRouter per the description) is configured in Builder's AI settings, since resolve_api_key must have a stored key to spend - if no key is configured there is nothing to abuse; and (3) the attacker possesses any authenticated non-Guest session (PR:L), which can be a Website User with no Builder access at all. Limiting factors that reduce realistic risk: authentication is required (not anonymous/remote-unauthenticated), the impact is confined to consuming the owner's LLM credits with no read/write access to site data, and sites without a configured AI key or already on 1.36.0 (where the endpoint is removed) are not exploitable.

This is a genuine but modest-severity issue best characterized as abuse of paid resources rather than a system compromise. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the confirming GHSA advisory agree: exploitation is network-based, low-complexity, requires no user interaction, and needs only a low-privilege authenticated session (PR:L) - specifically any logged-in non-Guest user, even a Website User with no Builder access. The impact is limited to availability of a financial resource (VA:L; VC:N/VI:N) - consumption of the site owner's AI/LLM credits - with no confidentiality or integrity impact, which is why the score lands at 5.3 (Medium). No EPSS score, SSVC exploitation/automatable/technical-impact decision, or CISA KEV status was supplied in the input, so widespread-exploitation probability cannot be quantified from the data; the only prioritization signal present is the vuln.today 'this_month' label, consistent with a Medium, non-emergency issue. No public exploit was identified at time of analysis. The key gating factor that holds real-world risk below the raw CVSS is deployment-dependent: exploitation only works where an AI provider key is actually configured in Builder's AI settings, and only against the narrow version band 1.33.0-1.35.x. Net: a real priority worth patching this month for affected deployments, but a financial/abuse problem, not a data-breach or RCE emergency.

An attacker who holds or registers any non-Guest account on a Frappe Builder site (for example a low-privilege Website User with no Builder permissions) sends repeated requests to the builder.ai.api.improve_prompt API. Because the endpoint performs no permission check, resolve_api_key supplies the site owner's stored AI provider (OpenRouter) key, so each call runs an LLM completion billed to the owner and returns the output to the caller, effectively turning the site into a free LLM proxy. No public exploit was identified at time of analysis, but the call is a single authenticated API request with no special complexity.