Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render… (CVE-2026-82634)

The Frappe Framework development builds contain an authorization bypass vulnerability (CVE-2026-82634) in the render_jinja_template endpoint. This flaw permits users with limited privileges (print permission) to render arbitrary Jinja templates by submitting raw template strings. As a result, attackers can execute arbitrary SQL SELECT queries on unrelated tables, potentially exposing sensitive information like password hashes stored in the __Auth table. The vulnerability is tracked under CWE-863 (Improper Authorization). No patch or remediation details are provided in the available data.

An attacker with print permission on any document can exploit this vulnerability to execute arbitrary SELECT queries on the database, potentially accessing sensitive information such as password hashes from the __Auth table. This could lead to unauthorized data disclosure. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict print permissions to trusted users only and monitor for suspicious use of the render_jinja_template endpoint in development environments.