Is CVE-2026-109598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109598 being exploited in the wild.

How severe is CVE-2026-109598?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

Which products and versions are affected?

Frappe Framework before 15.120.0, 16.x before 16.33.0.

Is there a fix for CVE-2026-109598?

Yes: fixed in Frappe Framework 15.120.0, 16.33.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109598 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109598?

Check whether you run Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109598: Frappe Framework missing authorization in send_sms API

CVE-2026-109598 · Severity: medium · CVSS 4.3 · Published 2026-10-12

Frappe Framework is a web application development platform used to build enterprise business applications. An authorization flaw in the send_sms API endpoint allows unauthorized users to send SMS messages impersonating the company, potentially enabling phishing, fraud, or credential harvesting attacks without proper access controls.

Technologies: Frappe Framework. Vendors: Frappe.

Quick answers

Is CVE-2026-109598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109598 being exploited in the wild.
How severe is CVE-2026-109598?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: Frappe Framework before 15.120.0, 16.x before 16.33.0.
Is there a fix for CVE-2026-109598?: Yes: fixed in Frappe Framework 15.120.0, 16.33.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109598 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109598?: Check whether you run Frappe Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Frappe Framework 15.120.0, 16.33.0

Technical details

A missing authorization check in the whitelisted send_sms endpoint (CWE-862) permits unauthenticated or insufficiently privileged API callers to invoke SMS functionality. The vulnerability allows an attacker to send arbitrary SMS messages on behalf of the organization without the required permissions, achieved via direct API invocation over the network.

Affected products

Frappe Framework before 15.120.0, 16.x before 16.33.0

Timeline

2026-09-28: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.