Frappe Technologies
Monthly
Frappe Cloud and ERPNext fail to properly validate the email field in the self-service registration endpoint /api/method/press.api.account.signup, allowing unauthenticated remote attackers to supply multiple email addresses and have the OTP code delivered to all of them as long as one address is valid. This can lead to OTP interception, impersonation during registration, creation of accounts using other people's email addresses without mailbox access, and indirect confirmation of already registered emails. The issue is rated moderate (CVSS 4.0 6.9, CVSS 3.1 6.9 with low confidentiality and integrity impact); no public exploit identified at time of analysis, and impact is limited to deployments that expose open self-service signup.
Frappe Cloud and ERPNext fail to properly validate the email field in the self-service registration endpoint /api/method/press.api.account.signup, allowing unauthenticated remote attackers to supply multiple email addresses and have the OTP code delivered to all of them as long as one address is valid. This can lead to OTP interception, impersonation during registration, creation of accounts using other people's email addresses without mailbox access, and indirect confirmation of already registered emails. The issue is rated moderate (CVSS 4.0 6.9, CVSS 3.1 6.9 with low confidentiality and integrity impact); no public exploit identified at time of analysis, and impact is limited to deployments that expose open self-service signup.