Description
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.
Published: 2026-10-12
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized record creation via missing authorization checks
Action: Apply Patch
AI Analysis

Impact

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 contain endpoints that fail to enforce authorization checks, allowing an attacker to create arbitrary records. The vulnerability also allows enumeration of record availability even if an administrator has disabled the feature, effectively exposing system state to unauthenticated users.

Affected Systems

The flaw affects the Frappe ERPNext product from the frappe vendor. All deployments of ERPNext with a release earlier than 15.110.0 or 16.21.0 are susceptible, regardless of the configured administrative settings that aim to disable the vulnerable functionality.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so precise exploitation likelihood is unknown. Since the vulnerability is exploitable by unauthenticated remote attackers calling web endpoints, the potential impact is wide‑area system compromise, and the vulnerability is not currently listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 13, 2026 at 00:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.110.0 or later, or 16.21.0 or later, to apply the vendor fix.
  • If upgrading immediately is not possible, restrict network access to the affected endpoints using firewalls or reverse‑proxy ACLs to prevent unauthenticated access.
  • If the feature is intentionally disabled, verify that the configuration still enforces role‑based access controls and re‑enable default authorization checks for the affected endpoints.

Generated by OpenCVE AI on October 13, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.
Title Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:22:16.788Z

Reserved: 2026-10-12T21:05:57.847Z

Link: CVE-2026-109641

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:29.720

Modified: 2026-10-12T23:17:29.840

Link: CVE-2026-109641

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:00:14Z

Weaknesses