CVE-2026-115718
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.
Risk Assessment
Unauthorized use of the API key can generate costs and LLM resource abuse. It may also violate quotas and harm the organization's reputation.
Recommendation
Update Frappe Builder to version 1.36.0 or later.
Other vulnerabilities in Frappe Builder
See all- CVE-2026-115720Medium
Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.
- CVE-2026-115717High
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL.
Original NVD description (English source)
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS