CVE-2026-109672

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.

Score

CVSS 4.0 7.1 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-10-12

Last modified

2026-10-14

Weaknesses

CWE-862

Affected products

• Erpnext (Frappe)

References

• https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6
• https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data