Skip to content
OpenAdvisories

Product · Frappe Technologies

builder

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-115720

    Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

    Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guard validates only the initial hostname before callers invoke requests.get(url) with default redirect-following and no IP …

    Frappe Technologies builder
  • Medium 4.3
    CVE-2026-115718

    Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

    Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improv…

    Frappe Technologies builder