What happened
Frappe Builder's improve_prompt endpoint lacks authorization checks, so any authenticated non-Guest user can trigger LLM completions that spend the site owner's AI quota. Fixed in v1.36.0. CVSS 4.3, published 2026-10-26.
Why it matters
This is an authorization gap on an AI-invoking endpoint: a low-privilege tenant user can burn the owner's LLM credits and drive the configured model, converting a business tool into an unguarded LLM usage sink.
Attack vector
Any authenticated non-Guest session calls improve_prompt to invoke LLM completions using the site owner's configured LLM credentials/quota, without per-action authorization, enabling quota/credit abuse or content generation on the tenant's behalf.
Affected systems
Frappe Builder 1.33.0 to before 1.36.0 (improve_prompt endpoint).
Mitigation
Upgrade to Frappe Builder 1.36.0 or later.