CVE-2026-109598

Executive Summary

CVE-2026-109598 is a missing authorization vulnerability (CWE-862) in the Frappe Framework's whitelisted send_sms API endpoint. The endpoint does not verify that the caller holds the permissions required to send SMS messages, allowing any authenticated low-privileged user to invoke it and dispatch arbitrary SMS messages that impersonate the Company. Organizations running Frappe Framework versions before 15.120.0 or 16.x before 16.33.0 are affected, with a primary impact of integrity loss (unauthorized outbound communications) rather than data confidentiality or availability loss.

Technical Analysis

The vulnerability resides in the send_sms API endpoint, which Frappe exposes as a whitelisted method (i.e., callable by authenticated clients over the framework's standard remote API). "Whitelisted" in Frappe means the method is intentionally made reachable by API consumers rather than restricted to internal server-side calls. The core defect is a missing authorization check: the endpoint does not validate that the invoking user possesses the permissions required to send SMS messages, which violates the expected server-side access control model.

Because the missing control is an authorization check and not a parsing or memory-safety flaw, exploitation requires only that the attacker be able to reach the endpoint — typically as an authenticated user with a valid session or API key. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the profile: network reachable, low attack complexity, requires low privileges, no user interaction, changes are scoped to the vulnerable component, and the sole impact is a low-severity integrity violation. No confidentiality or availability impact is indicated.

The specific parameter names, request schema, and internal role/permission constants used by send_sms are not disclosed in the available NVD description. The endpoint name send_sms is the only implementation-specific identifier available and is used verbatim. The underlying SMS gateway configuration, recipient list handling, and message body construction are not documented in the provided data and should not be assumed.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-109598, and no exploit code or Nuclei template is available. The attack chain below is therefore inferred at the vulnerability-class level (missing authorization on a reachable API endpoint) and is constrained to identifiers present in the NVD description.

1. Reconnaissance / target identification: The attacker identifies internet- or intranet-exposed Frappe Framework deployments (self-hosted ERPNext and custom Frappe applications are the typical distribution). Public Frappe deployments commonly expose the framework's API surface. Fingerprinting of Frappe-based sites is straightforward and does not require the vulnerability itself.

2. Gaining a foothold at low privilege: The flaw is exploitable by a user who lacks the SMS-sending permission — for example a newly created user, a low-privilege operator, or an account obtained by other means. Because the endpoint is whitelisted, it is reachable through the standard authenticated API path; the attacker only needs a valid authenticated session or API credential (consistent with PR:L). No privilege escalation, special role, or administrative access is needed.

3. Triggering the flaw class: The attacker invokes the send_sms endpoint. The server executes the method because it is whitelisted, but it fails to perform the authorization check that would confirm the caller is permitted to send SMS. Because the access-control decision is absent rather than merely weak, the request is processed on the strength of the caller's authenticated identity alone. The attacker supplies the recipient and message content, causing the platform to transmit SMS messages.

4. Post-exploitation impact: The attacker can send arbitrary SMS messages that impersonate the Company. Concrete consequences include SMS-based social engineering and phishing (smishing) directed at customers or staff, brand/reputation damage, and abuse of any paid SMS gateway quota (cost impact). Because the messages originate from the organization's trusted SMS channel, recipients are likely to treat them as legitimate. There is no indicated ability to read data, modify records, or cause service disruption through this specific flaw.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium), derived from AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Scope is unchanged — the impact is confined to the vulnerable Frappe component. Confidentiality: None. Integrity: Low — the organization's outbound communications channel can be misused to deliver attacker-chosen content impersonating the Company. Availability: None per the vector.

Business impact is concentrated in trust and abuse-of-service: successful exploitation enables smishing/social engineering under the organization's identity, potential customer and partner deception, regulatory and brand exposure if attacker-controlled SMS is attributed to the company, and consumption of the SMS gateway budget. Blast radius is limited to deployments where a low-privileged authenticated account exists and the affected version is running. Internet-exposed Frappe/ERPNext instances present the largest exposure because the endpoint is network reachable (AV:N) and requires minimal attacker effort (AC:L).

Detection Guidance

Sigma Rule

title: Frappe Framework Unauthorized send_sms API Invocation (CVE-2026-109598)
id: 6f2a9c14-7d3e-4b8a-9f21-frappe109598
status: experimental
description: Detects requests to the Frappe whitelisted send_sms endpoint, indicating possible exploitation of CVE-2026-109598 (missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109598
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains: 'send_sms'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-uri-query
  - cs-method
  - cs-username
falsepositives:
  - Legitimate SMS-sending by authorized integrations
level: medium
tags:
  - attack.t1190
  - cve.2026.109598

YARA Rule

rule CVE_2026_109598_Frappe_send_sms_Missing_Authz
{
    meta:
        description = "Detects Frappe framework source referencing the send_sms whitelisted endpoint associated with CVE-2026-109598"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109598"
        cve = "CVE-2026-109598"

    strings:
        $a = "send_sms" ascii wide
        $b = "" ascii wide
        $c = "whitelist" ascii nocase
        $d = "sms" ascii nocase

    condition:
        uint16(0) == 0x3c3f or $a or ($c and $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109598 Frappe Framework unauthorized send_sms API invocation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"send_sms"; nocase; reference:cve,2026-109598; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109598; classtype:attempted-user; sid:2026109598; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and url.path : "*send_sms*" ]

Splunk SPL Query

index=web sourcetype=access_common (cs_method=POST OR http_method=POST)
| eval uri=coalesce(uri, cs_uri_query, url)
| where match(uri, "(?i)send_sms")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, cs_username
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="frappe,web,cve-2026-109598,">
  <rule id="109598" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>send_sms</url>
    <description>CVE-2026-109598: Possible unauthorized Frappe send_sms API invocation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109598,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is currently provided by tracked feeds.

1. Immediate mitigations:

   • Restrict network access to the Frappe API surface so that only trusted networks or known integration clients can reach whitelisted endpoints; place the application behind a reverse proxy or VPN where feasible.
   • Reduce the population of low-privileged authenticated accounts, and audit existing accounts for necessity.
   • Monitor outbound SMS gateway usage for volume anomalies or messages not attributable to known workflows, since the impact is unsolicited/impersonating SMS traffic.
   • Where the endpoint is not required for business operations, block or disable access to send_sms at the web server/proxy layer.

2. Patch/upgrade steps:

   • The NVD description indicates the issue is addressed in Frappe Framework 15.120.0 and 16.33.0. When patches become available from the vendor, upgrade affected installations to 15.120.0-or-later or 16.33.0-or-later.
   • Because patch confidence is 0/4 and no vendor fix source is confirmed, validate any candidate release against the vendor's official advisory before relying on it.
   • Test upgrades in a staging environment and verify that the send_sms authorization behavior is corrected.

3. Long-term hardening:

   • Enforce server-side authorization checks on all whitelisted API endpoints; do not rely on client-side or UI-level controls.
   • Adopt least privilege for API credentials and integrate periodic permission reviews.
   • Add regression tests asserting that low-privilege users receive authorization failures when invoking sensitive endpoints such as send_sms.
   • Maintain centralized logging and alerting for API-to-SMS workflows.

References

• NVD — CVE-2026-109598: https://nvd.nist.gov/vuln/detail/CVE-2026-109598
• MITRE CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CVSS 3.1 Specification — https://www.first.org/cvss/v3.1/specification-document
• Frappe Framework project — https://frappeframework.com/

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-109598. CISA KEV does not list this CVE, and no threat actor campaigns or exploit-in-the-wild evidence are documented in the provided data.