CVE-2026-115718

Frappe Builder lets ordinary users spend the owner’s AI credits

Frappe · Builder AI improve_prompt endpoint

First documented disclosure · Review checkpoint

Summary

A logged-in user without Builder access could run completions using the site’s configured AI-provider key.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The improve_prompt endpoint omitted authorization before resolving the stored OpenRouter API key.

Conditions required

Any authenticated non-Guest session and a configured provider key.

Potential impact

Unauthorized consumption of paid LLM credits and returned model output.

Affected versions and configurations

1.33.0 through versions before 1.36.0.

Fix and mitigation status

1.36.0; the 1.36.x line requires Frappe 16.36.1 or later.

Practical next steps

Upgrade; until then remove the provider key from Builder’s AI settings.

Operating lesson

A valid application login must not automatically confer permission to spend AI-provider credits.

Evidence and limits

October 6 public technical fix predates the October 26 advisory and CVE; a contemporaneous PR review establishes the commit was publicly present. The maintainer removed the endpoint. CNA CVSS 4.0 is 5.3; the advisory’s CVSS 3.1 score is 4.3. Neither establishes observed financial loss.

Sources