CVE-2026-82634

Frappe Framework development builds contain an incorrect-authorization flaw (CWE-863) in the render_jinja_template endpoint. A low-privileged user who holds print permission on any document can invoke the endpoint with raw Jinja template strings, which the server renders without adequate privilege checks. Because rendered templates can issue queries, the attacker can execute arbitrary SELECT statements against tables unrelated to their permissions, including reading password hashes from the __Auth table, giving high confidentiality impact with no integrity or availability impact (CVSS 4.0: 7.1, AV:N/PR:L/VC:H). Any deployment running an affected development build of Frappe Framework, including self-hosted and hosted ERPNext-based installs, is potentially exposed; the available data does not specify a fixed version range. There is currently no known exploitation: no public proof-of-concept, no CISA KEV listing, and EPSS assigns a 0.2% probability of exploitation within 30 days (15th percentile).

What to do: Update Frappe Framework to a patched release as soon as the vendor publishes one, and verify whether your deployment is running an affected development build. In the interim, audit and restrict which low-privileged users hold print permission, and limit or disable access to the render_jinja_template endpoint for untrusted users. If compromise is suspected, rotate credentials, since __Auth password hashes are readable by an attacker.