CVE-2026-115718

A flaw was found in Frappe Builder. A missing authorization check in the improveprompt endpoint allows an authenticated remote attacker to invoke Large Language Model LLM completions using the site owner's stored credentials. By exploiting this issue, an attacker can exhaust paid service credits...

CVE-2026-115718

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

EUVD-2026-109780

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718

Frappe Builder versions 1.33.0 before 1.36.0 are susceptible to a missing authorization vulnerability within the improve_prompt endpoint. This flaw allows any authenticated non-Guest session to bypass permission checks and invoke LLM completions. By calling the improve_prompt API, an attacker can...