CVE-2026-109613: Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Q: Which deployments are affected?

Affected versions are ERPNext releases before 15.121.0 and 16.x releases before 16.34.0.

Q: What level of access does an attacker need?

An attacker must be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoints are reachable over the network.

Q: What can an attacker do after exploiting this issue?

A low-privileged authenticated user can modify document status data beyond the permissions assigned to their role, bypassing intended role-based access restrictions. The reported impact includes high integrity impact and low availability impact.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.

Affected Software

1 affected component

Frappe ERPNext<15.121.0, >=16.0.0<16.34.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 15.121.0
Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 16.34.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are ERPNext releases before 15.121.0 and 16.x releases before 16.34.0.

What level of access does an attacker need?

An attacker must be authenticated as a low-privileged user. No user interaction is required, and the vulnerable endpoints are reachable over the network.

What can an attacker do after exploiting this issue?

A low-privileged authenticated user can modify document status data beyond the permissions assigned to their role, bypassing intended role-based access restrictions. The reported impact includes high integrity impact and low availability impact.

CVE-2026-109613: Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What can an attacker do after exploiting this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What can an attacker do after exploiting this issue?