CVE-2026-109598: Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Q: Which deployments are exposed?

Frappe Framework deployments before 15.120.0, and 16.x deployments before 16.33.0, are affected if the whitelisted send_sms API endpoint is available.

Q: What does an attacker need to exploit this issue?

The attacker needs credentials for a user account, but that user does not need the permissions normally required to send SMS messages. No user interaction is required.

Q: What is the practical impact of successful exploitation?

An unauthorized authenticated user can invoke send_sms to send arbitrary SMS messages that impersonate the Company. The reported impact is integrity-related rather than disclosure or service availability.

Q: How can I determine whether unauthorized SMS sending may already have occurred?

Review SMS sending records and API activity for send_sms requests made by accounts that were not authorized to send SMS messages. Compare the requesting user with the permissions expected for SMS sending and investigate messages that appear to originate from the Company.

Published Oct 12, 2026

Updated

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS messages that impersonate the Company.

Affected Software

1 affected component

Frappe Frappe Framework<15.120.0, >=16.0.0<16.33.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Frappe Framework deployments before 15.120.0, and 16.x deployments before 16.33.0, are affected if the whitelisted send_sms API endpoint is available.

What does an attacker need to exploit this issue?

The attacker needs credentials for a user account, but that user does not need the permissions normally required to send SMS messages. No user interaction is required.

What is the practical impact of successful exploitation?

An unauthorized authenticated user can invoke send_sms to send arbitrary SMS messages that impersonate the Company. The reported impact is integrity-related rather than disclosure or service availability.

How can I determine whether unauthorized SMS sending may already have occurred?

Review SMS sending records and API activity for send_sms requests made by accounts that were not authorized to send SMS messages. Compare the requesting user with the permissions expected for SMS sending and investigate messages that appear to originate from the Company.

CVE-2026-109598: Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

How can I determine whether unauthorized SMS sending may already have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

How can I determine whether unauthorized SMS sending may already have occurred?