CVE-2026-115718

A flaw was found in Frappe Builder. A missing authorization check in the improveprompt endpoint allows an authenticated remote attacker to invoke Large Language Model LLM completions using the site owner's stored credentials. By exploiting this issue, an attacker can exhaust paid service credits...

CVE-2026-115717

A flaw was found in Frappe Builder. An authenticated user with low privileges can trigger a Server-Side Request Forgery SSRF vulnerability by submitting a malicious URL to the converttowebp API endpoint, which lacks proper access controls and redirect validation. This allows the attacker to coerc...

CVE-2026-115718

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115720

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115717

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

CVE-2026-115720 Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115720

Frappe Builder versions before 1.36.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in builder/api.py. The root cause is that the assert_not_private_url() guard only validates the initial hostname, while subsequent requests.get(url) calls follow redirects by default without...

EUVD-2026-109785

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-115717

Frappe Builder versions before 1.36.1 are vulnerable to a Server-Side Request Forgery (SSRF) in the convert_to_webp API endpoint. The flaw exists because the endpoint lacks the has_page_write access control used by other asset-ingest handlers and performs an unprotected requests.get call that fol...

CVE-2026-115717 Frappe Builder before 1.36.1 SSRF via convert_to_webp

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

EUVD-2026-109781

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the converttowebp API endpoint, which lacks the haspagewrite access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

CVE-2026-115718

Frappe Builder versions 1.33.0 before 1.36.0 are susceptible to a missing authorization vulnerability within the improve_prompt endpoint. This flaw allows any authenticated non-Guest session to bypass permission checks and invoke LLM completions. By calling the improve_prompt API, an attacker can...

CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

EUVD-2026-109780

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

PT-2026-123286

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert to webp API endpoint, which lacks the has page write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without...

PT-2026-123287

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve prompt API to leverage the site owner...