---
id: CVE-2026-82634
title: >-
  Frappe Framework development builds contain an authorization flaw in the
  render_jinja_template endpoint that allows low-privileged users to render
  arbitrary Jinja templates by supplying raw template strings
summary: >-
  Frappe Framework development builds contain an authorization flaw in the
  render_jinja_template endpoint that allows low-privileged users to render
  arbitrary Jinja templates by supplying raw template strings. Attackers with
  print permissi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
published: '2026-08-30'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:53:23.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82634'
references:
  - url: 'https://github.com/frappe/frappe'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/frappe/frappe/blob/0a80046da32bb8976cd7854f551c179a4a06b1b3/frappe/utils/print_format_generator.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/frappe/frappe/commit/37d2eb59790633da01c741b950cc00ca3558c494
    label: disclosure@vulncheck.com
  - url: 'https://github.com/frappe/frappe/pull/40710'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-framework-development-branch-incorrect-authorization-via-jinja-template-preview-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00415
epssPercentile: 0.33247
ingestedAt: '2026-08-30T23:59:27.841Z'
---

## Overview

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.