CVE-2026-109599: Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe versions before 15.113.3 are affected, as are 16.x versions before 16.25.0.
What access does an attacker need?
An attacker must be authenticated with a valid user account. No user interaction is required, and exploitation can be performed remotely by sending requests to the affected endpoints.
What is the likely impact of successful exploitation?
An authenticated user may modify records that exceed the permissions assigned to their role. The provided severity vector indicates integrity impact only; no confidentiality or availability impact is identified.
How can teams determine whether they are exposed?
Verify the deployed Frappe version. Instances running a release earlier than 15.113.3, or a 16.x release earlier than 16.25.0, should be treated as affected.