Medium severity4.3NVD Advisory· Published Oct 26, 2026

CVE-2026-115718

Description

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/builderllm-create
Range: <1.36.0

Patches

Vulnerability mechanics

References

github.com/frappe/builder/releases/tag/v1.36.0nvd
github.com/frappe/builder/security/advisories/GHSA-58mj-c563-p78wnvd
www.vulncheck.com/advisories/frappe-builder-before-missing-authorization-via-improve-promptnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000