Description
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.
Published: 2026-10-12
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized Data Access
Action: Apply Patch
AI Analysis

Impact

An endpoint in Frappe ERPNext that processes a caller‑supplied flag disables its own permission enforcement. An authenticated attacker can provide this flag when calling the endpoint, allowing them to read party records that would normally be beyond their role. The flaw is an authorization bypass (CWE-862) that compromises confidentiality by exposing information to users without proper authorization.

Affected Systems

Products: Frappe ERPNext. Affected releases include all 15.x versions before 15.120.0 and all 16.x releases before 16.23.0.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1, indicating a high severity risk. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Because the bypass requires authenticated access, an attacker must first authenticate to the system and then invoke the vulnerable endpoint, making the attack practical for internal or compromised users.

Generated by OpenCVE AI on October 12, 2026 at 23:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to ERPNext 15.120.0 or later, or 16.23.0 or later to apply the vendor fix.
  • If upgrading immediately is not possible, remove or ignore the caller‑supplied bypass flag in the endpoint configuration to restore standard permission checks.
  • Validate that party record endpoints enforce the correct role‑based access controls after applying the fix or configuration change.

Generated by OpenCVE AI on October 12, 2026 at 23:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.
Title Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:22:03.717Z

Reserved: 2026-10-12T21:04:35.630Z

Link: CVE-2026-109621

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:26.190

Modified: 2026-10-12T23:17:26.313

Link: CVE-2026-109621

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T23:45:12Z

Weaknesses