CVE-2026-109610
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
Risk Assessment
A low-privileged user can modify documents and data they should not access, violating data integrity and the permission model. This may lead to unauthorized changes in business processes.
Recommendation
Update Frappe ERPNext to version 15.119.1 or 16.32.0 (or later). Until patched, restrict access to the vulnerable endpoints to trusted roles only.
Other vulnerabilities in Frappe ERPNext
See all- CVE-2026-109674Medium
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation.
- CVE-2026-109673High
Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers.
- CVE-2026-109672Medium
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks.
- CVE-2026-109671High
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages.
- CVE-2026-109670Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping.
- CVE-2026-109669Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes.
- CVE-2026-109668Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role.
- CVE-2026-109667High
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts.
- CVE-2026-109666Medium
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records.
- CVE-2026-109665Medium
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks.
Original NVD description (English source)
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS