The Frappe Framework contains a missing authorization check on the send_sms API endpoint. This flaw allows any authenticated user who does not have the required permissions to instruct the system to send SMS messages on behalf of the company, effectively enabling arbitrary SMS messages that appear to originate from the organization. The direct consequence is the potential for phishing, reputation damage, or non‑compliance with communication regulations, though it does not directly compromise system integrity or confidentiality.

Frappe Framework from the Frappe vendor is affected. Versions earlier than 15.120.0 and all 16.x prior to 16.33.0 contain the vulnerability and must be addressed.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only access to the API endpoint, which most authenticated users can reach if they possess any user credentials. The likely attack vector is an internal or exposed API request where the caller submits an SMS payload; the absence of permission checks enables the action without further prerequisites. Given the moderate CVSS and lack of public exploitation data, the risk is significant but not exploitable remotely by unauthenticated actors.