CVE-2026-109615: Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Q: Which deployments are affected?

Frappe ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.

Q: What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

Q: What is the practical impact?

A low-privileged user can create documents associated with records that are outside the permissions granted by their role, bypassing role-based access controls.

Q: What versions address the issue?

Upgrade ERPNext to version 15.121.0 or later on the 15.x branch, or to version 16.34.0 or later on the 16.x branch.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.

Affected Software

1 affected component

Frappe ERPNext<15.121.0, >=16.0.0<16.34.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.

What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

What is the practical impact?

A low-privileged user can create documents associated with records that are outside the permissions granted by their role, bypassing role-based access controls.

What versions address the issue?

Upgrade ERPNext to version 15.121.0 or later on the 15.x branch, or to version 16.34.0 or later on the 16.x branch.

CVE-2026-109615: Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the practical impact?

What versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the practical impact?

What versions address the issue?