Description
Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data modification
Action: Apply patch
AI Analysis

Impact

The vulnerability is a missing authorization flaw in specific Frappe ERPNext endpoints. The flaw allows an authenticated user to send requests that bypass role‑based restrictions and alter documents or data beyond what their permissions normally allow. This can lead to integrity violations and unauthorized data changes within the system.

Affected Systems

Versions of Frappe ERPNext before 15.121.1 and before 16.34.2 are affected. The disclosed points affect endpoints that are intended to be role‑protected, enabling users with limited roles to modify documents they should not have access to.

Risk and Exploitability

The CVSS base score is 5.3, reflecting a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the system and then target the specific endpoints lacking proper authorization checks. Given these conditions, the likelihood of exploitation is moderate but it remains a serious concern for data integrity.

Generated by OpenCVE AI on October 13, 2026 at 00:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.121.1 or later, or to 16.34.2 or later, to receive the fix for the missing authorization checks.
  • Review user role assignments and audit logs to ensure no unauthorized changes have occurred and to detect any potential misuse.
  • Limit API access to the affected endpoints to trusted services or users until the vulnerability is remediated.
  • Continuously monitor for unexpected document modifications and apply additional controls as needed.

Generated by OpenCVE AI on October 13, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.
Title Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:22:05.038Z

Reserved: 2026-10-12T21:04:35.631Z

Link: CVE-2026-109623

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:26.530

Modified: 2026-10-12T23:17:26.650

Link: CVE-2026-109623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:15:14Z

Weaknesses