Frappe EUVD-2026-36485

The submit_discussion() endpoint must be reachable over the network, which is typical of any internet-facing Frappe or ERPNext deployment. Per the CVSS 4.0 PR:N rating, no authentication credentials are required. No non-default configuration, feature flag, or special deployment mode is needed - the discussion feature is a standard component of the Frappe framework. Exploitation is bounded to low-integrity writes only, with no path to data exfiltration or service disruption. Deployments that enforce authenticated sessions for all application routes at the network or reverse-proxy layer (e.g., Nginx auth_request, VPN-gating) would prevent unauthenticated exploitation even prior to patching.

The CVSS 4.0 score of 6.9 reflects a fully unauthenticated (PR:N), low-complexity (AC:L), network-accessible (AV:N) attack surface, but the blast radius is deliberately narrow - only low-integrity writes to the vulnerable system (VI:L) with no confidentiality or availability impact confirmed. EPSS at 0.03% (9th percentile) signals that the broader threat-intelligence community does not anticipate widespread automated exploitation in the near term. There is no CISA KEV listing and no known public exploit. The Authentication Bypass tag in the CVE metadata is consistent with the CVSS PR:N rating but does not elevate the practical risk beyond what the limited impact scope already bounds. Real-world priority is low for most operators; however, deployments where Frappe discussion submissions feed into approval workflows, audit trails, or downstream notifications face a slightly elevated business risk from forged or injected discussion entries. No conflicting signals are present in the available data.

An unauthenticated attacker identifies an internet-facing Frappe or ERPNext instance and sends a crafted HTTP POST request directly to the submit_discussion() endpoint, supplying an arbitrary target resource identifier. Because the endpoint performs no authorization check, the server accepts the request and persists the forged discussion entry against a document the attacker does not own. No public exploit code has been identified at time of analysis, but the low complexity and absence of authentication requirements make manual exploitation straightforward for anyone familiar with the Frappe HTTP API.