Authorization Flaw in Frappe Framework Allows Arbitrary Template Rendering

CVE-2026-82634

What is CVE-2026-82634?

The Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint. This vulnerability allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Specifically, attackers with print permissions on any document may execute arbitrary SELECT statements against unrelated tables. This includes the potential to read sensitive information such as password hashes from the __Auth table, thereby posing a significant risk to the integrity and security of user data.

References