{"schema":"threatline.record/2","record":{"id":"GHSA-wrh5-p77r-jpvq","aliases":["GHSA-wrh5-p77r-jpvq"],"summary":"Unauthorized users can send sms via the API","details":"### Impact\r\n\r\nBroken Authorization allows unauthorized users to send sms via the whitelisted `send_sms` endpoint. This allows users to impersonate the Company and send sms as the Company itself.\r\n\r\n### Patches\r\n\r\nThe issue has been patched, updating to the latest versions of Frappe Framework should resolve this.\r\n\r\n### Workarounds\r\n\r\nThere are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.\r\n","categories":["Unclassified"],"product":"frappe","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvq","source_modified_at":"2026-09-28T03:40:47Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"pip","name":"frappe"},"range":"<v16.33.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvq","source_modified_at":"2026-09-28T03:40:47Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"pip","name":"frappe"},"range":"<v15.120.0"}],"fixed_versions":[],"cvss":null,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T03:40:47Z","modified_at":"2026-09-28T03:40:47Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvq","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-28T03:40:47Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T03:40:47Z","content_hash":"1300b38f781e9acc4eee42757d904839a2d71888bc25dfbf1fc7b1bcf66c4658"}}