CVE-2026-109598: Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS messages that impersonate the Company.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Frappe Framework deployments before 15.120.0, and 16.x deployments before 16.33.0, are affected if the whitelisted send_sms API endpoint is available.
What does an attacker need to exploit this issue?
The attacker needs credentials for a user account, but that user does not need the permissions normally required to send SMS messages. No user interaction is required.
What is the practical impact of successful exploitation?
An unauthorized authenticated user can invoke send_sms to send arbitrary SMS messages that impersonate the Company. The reported impact is integrity-related rather than disclosure or service availability.
How can I determine whether unauthorized SMS sending may already have occurred?
Review SMS sending records and API activity for send_sms requests made by accounts that were not authorized to send SMS messages. Compare the requesting user with the permissions expected for SMS sending and investigate messages that appear to originate from the Company.