Description
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Email Disclosures
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Frappe ERPNext allows an authenticated attacker to trigger transactional emails for documents they should not be able to read. Because the endpoints do not verify authorization before sending the email, the email content can expose sensitive document information, thereby compromising confidentiality. This flaw is classified as CWE-862, Missing Authorization.

Affected Systems

Affect vendors: Frappe ERPNext. Versions prior to 15.119.0 and all 16.x releases before 16.31.0 are impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user, so the attack vector is internal. While no public exploits are known, legitimate users with sufficient privileges could abuse the endpoints to leak document details via email.

Generated by OpenCVE AI on October 13, 2026 at 00:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.119.0 or later, and to 16.31.0 or later for 16.x releases.
  • Restrict access to the transactional email endpoints by configuring role-based permissions so that only users with explicit rights can trigger email notifications.
  • Monitor outbound email logs for anomalous transactional email activity and audit permissions regularly.

Generated by OpenCVE AI on October 13, 2026 at 00:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.
Title Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T13:41:24.071Z

Reserved: 2026-10-12T21:06:47.173Z

Link: CVE-2026-109654

cve-icon Vulnrichment

Updated: 2026-10-13T13:41:20.437Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:32.053

Modified: 2026-10-13T14:17:30.110

Link: CVE-2026-109654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T05:00:11Z

Weaknesses