Missing Authorization in Frappe Builder Affects OpenRouter API Access
CVE-2026-115718

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Builder
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115718?

Versions of Frappe Builder from 1.33.0 to prior to 1.36.0 are susceptible to a missing authorization vulnerability. The flaw exists in the improve_prompt endpoint, allowing authenticated non-Guest users to misuse the API and invoke LLM completions without appropriate permission checks. This exploitation could enable unauthorized users to access the site owner’s stored OpenRouter API key, leading to unauthorized consumption of paid LLM credits and effectively transforming the site into a free LLM proxy. It's essential for users of affected versions to apply the security patch available in version 1.36.0 or later.

Affected Version(s)

builder 1.33.0 < 1.36.0

References

https://github.com/frappe/builder/releases/tag/v1.36.0
patch
https://github.com/frappe/builder/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/frappe-builder-befor...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mansurzhan Mavlankulov
.