Description
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.
Published: 2026-10-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Disclosure
Action: Apply Patch
AI Analysis

Impact

This vulnerability arises because certain endpoints in Frappe ERPNext fail to enforce proper authorization checks. An authenticated user with a low‑privileged role can exploit these endpoints to read financial data that they should not have access to. The flaw results in a violation of confidentiality for sensitive financial records.

Affected Systems

The affected product is Frappe ERPNext. The flaw exists in all releases before version 15.116.0 and in the 16.x series before version 16.27.0. All other releases are not impacted.

Risk and Exploitability

The CVSS score of 7.1 classifies the issue as medium‑to‑high severity. Exploitation requires only valid credentials; no additional barriers are needed beyond normal authentication. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is unavailable, so the likelihood of widespread exploitation is uncertain, but the exposed data is highly sensitive. The flaw permits unauthorized disclosure of financial information and could be leveraged to gain a broader understanding of an organization’s financial structure.

Generated by OpenCVE AI on October 13, 2026 at 00:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.116.0 or later, or 16.27.0 or later, to apply the vendor patch.
  • If an upgrade cannot be performed immediately, restrict network access to the affected endpoints so that only users with elevated privileges can reach them, and enforce strict role‑based access controls.
  • Apply any vendor‑supplied configuration changes or workarounds that mitigate the missing authorization checks, and audit role permissions to prevent regression.

Generated by OpenCVE AI on October 13, 2026 at 00:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.
Title Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T14:32:33.162Z

Reserved: 2026-10-12T21:07:34.160Z

Link: CVE-2026-109661

cve-icon Vulnrichment

Updated: 2026-10-15T14:32:27.830Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:33.213

Modified: 2026-10-15T15:17:27.497

Link: CVE-2026-109661

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:00:14Z

Weaknesses