CVE-2026-109610: Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Q: Which deployments are affected?

ERPNext versions before 15.119.1 are affected, as are 16.x versions before 16.32.0.

Q: Does exploitation require authentication or elevated privileges?

An attacker must be authenticated, but only needs a low-privileged account. No user interaction is required, and the vulnerable endpoints are reachable over the network.

Q: What is the impact of successful exploitation?

A low-privileged user can modify documents and data beyond the permissions assigned to their role. The provided impact information indicates integrity impact, with no stated confidentiality or availability impact.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.119.1, >=16.0.0<16.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.119.1 are affected, as are 16.x versions before 16.32.0.

Does exploitation require authentication or elevated privileges?

An attacker must be authenticated, but only needs a low-privileged account. No user interaction is required, and the vulnerable endpoints are reachable over the network.

What is the impact of successful exploitation?

A low-privileged user can modify documents and data beyond the permissions assigned to their role. The provided impact information indicates integrity impact, with no stated confidentiality or availability impact.

CVE-2026-109610: Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or elevated privileges?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or elevated privileges?

What is the impact of successful exploitation?