Description
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass
Action: Apply patch
AI Analysis

Impact

The vulnerability arises from missing authorization checks in specific party record endpoints. An authenticated user can send crafted requests to modify records that should be restricted, enabling unauthorized changes to party data.

Affected Systems

At risk are installations of Frappe ERPNext earlier than version 15.110.0 and 16.x earlier than version 16.21.0, which lack the necessary access controls for party record endpoints.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate impact. Public disclosure exists, but the EPSS score is not available, suggesting limited real‑world exploitation evidence. Attackers only need valid credentials with low privileges and network access, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, it presents a real integrity risk if not addressed.

Generated by OpenCVE AI on October 13, 2026 at 00:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.110.0 or later, or 16.21.0 or later.
  • If upgrading is not immediately possible, limit permissions on party record endpoints to authorized roles and disable low‑privileged access.
  • Continuously monitor transaction logs for unauthorized changes to party records and enforce least‑privilege usage.

Generated by OpenCVE AI on October 13, 2026 at 00:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.
Title Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:44:32.720Z

Reserved: 2026-10-12T21:07:34.160Z

Link: CVE-2026-109668

cve-icon Vulnrichment

Updated: 2026-10-13T15:48:03.791Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:34.370

Modified: 2026-10-13T17:17:31.353

Link: CVE-2026-109668

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T04:00:15Z

Weaknesses