Description
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.
Published: 2026-10-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure due to Missing Authorization
Action: Patch
AI Analysis

Impact

Certain endpoints in Frappe ERPNext release versions prior to 15.115.0 and 16.x prior to 16.26.0 fail to enforce proper authorization checks. Authenticated users are able to invoke these endpoints and read information, including personal data, that exceeds the permissions granted by their assigned role. This flaw permits a confidentiality violation where sensitive information can be disclosed to users who should not have access.

Affected Systems

Vendors impacted are Frappe ERPNext. The affected builds are all releases before v15.115.0 as well as all 16.x series before v16.26.0.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need valid user credentials and would typically exploit the flaw through the normal authentication workflow, suggesting that exploitation requires user-level access but allows broader data extraction beyond the user's role.

Generated by OpenCVE AI on October 13, 2026 at 00:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s security patch by upgrading ERPNext to a version newer than 15.115.0 or 16.26.0.
  • Conduct a role‑based access review to ensure users possess only the permissions required for their responsibilities.
  • If an upgrade cannot be performed immediately, restrict network access to the vulnerable endpoints or apply an API gateway rule that limits usage to known, trusted IP addresses.

Generated by OpenCVE AI on October 13, 2026 at 00:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.
Title Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:44:47.281Z

Reserved: 2026-10-12T21:06:47.173Z

Link: CVE-2026-109658

cve-icon Vulnrichment

Updated: 2026-10-13T15:48:12.327Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:32.710

Modified: 2026-10-13T17:17:31.120

Link: CVE-2026-109658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T06:00:15Z

Weaknesses