CVE-2026-109621: Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass

Q: Which deployments are affected?

Affected versions are ERPNext before 15.120.0 and ERPNext 16.x before 16.23.0. The issue is in an endpoint used to access party records.

Q: What does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account. They can supply a flag to the affected endpoint that disables its permission enforcement, without requiring user interaction.

Q: What information could be exposed?

The bypass allows an authenticated user to read party records that are outside the permissions assigned to their role. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Q: How can I determine whether I may be exposed?

Check the ERPNext version in use and identify whether it is earlier than 15.120.0, or is a 16.x release earlier than 16.23.0. Also review access to the affected party-record endpoint by authenticated users, particularly requests that provide a permission-disabling flag.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.

Affected Software

1 affected component

Frappe ERPNext<15.120.0, >=16.0.0<16.23.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 15.120.0
Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 16.23.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are ERPNext before 15.120.0 and ERPNext 16.x before 16.23.0. The issue is in an endpoint used to access party records.

What does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account. They can supply a flag to the affected endpoint that disables its permission enforcement, without requiring user interaction.

What information could be exposed?

The bypass allows an authenticated user to read party records that are outside the permissions assigned to their role. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

How can I determine whether I may be exposed?

Check the ERPNext version in use and identify whether it is earlier than 15.120.0, or is a 16.x release earlier than 16.23.0. Also review access to the affected party-record endpoint by authenticated users, particularly requests that provide a permission-disabling flag.

CVE-2026-109621: Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?

How can I determine whether I may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What information could be exposed?

How can I determine whether I may be exposed?