Description
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.
Published: 2026-10-12
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized Access / Bypass Role-Based Access Control
Action: Apply Patch
AI Analysis

Impact

The identified issue is a missing authorization check in certain document creation endpoints, allowing authenticated users with low privileges to create records beyond their granted role. This bypass of role‑based access controls can lead to unauthorized data creation and potential data integrity compromise.

Affected Systems

The vulnerability exists in Frappe ERPNext versions prior to 15.121.0 and in the 16.x line before 16.34.0. Systems running these releases are susceptible.

Risk and Exploitability

The CVSS score is 7.1, indicating high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers need valid credentials but can exploit the flaw over the network by invoking the exposed endpoints, so the risk is significant for organizations where low‑privileged users are allowed remote access.

Generated by OpenCVE AI on October 12, 2026 at 23:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.121.0 or later, or 16.34.0 or later.
  • If an upgrade is not immediately possible, block low‑privileged users from accessing the vulnerable document creation endpoints using role filters or network firewall rules.
  • Confirm that role‑based access control checks are correctly implemented for all custom modules and endpoints.

Generated by OpenCVE AI on October 12, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.
Title Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:22:01.804Z

Reserved: 2026-10-12T21:03:50.775Z

Link: CVE-2026-109615

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:25.687

Modified: 2026-10-12T23:17:25.807

Link: CVE-2026-109615

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:00:16Z

Weaknesses