CVE-2026-109625: Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Q: Which deployments are affected?

ERPNext versions before 15.121.3 are affected, as are 16.x versions before 16.35.0.

Q: What does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account. The vulnerable endpoints can then be requested without the role-based authorization checks that should restrict access to the financial data.

Q: Is this limited to administrators or highly privileged users?

No. The issue allows authenticated users to read financial data beyond the permissions assigned to their role, so exposure depends on which users can authenticate to the affected instance.

Q: What is the immediate remediation?

Upgrade ERPNext to 15.121.3 or later in the 15.x line, or to 16.35.0 or later in the 16.x line.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.

Affected Software

1 affected component

Frappe ERPNext<15.121.3, <16.35.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.121.3 are affected, as are 16.x versions before 16.35.0.

What does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account. The vulnerable endpoints can then be requested without the role-based authorization checks that should restrict access to the financial data.

Is this limited to administrators or highly privileged users?

No. The issue allows authenticated users to read financial data beyond the permissions assigned to their role, so exposure depends on which users can authenticate to the affected instance.

What is the immediate remediation?

Upgrade ERPNext to 15.121.3 or later in the 15.x line, or to 16.35.0 or later in the 16.x line.

CVE-2026-109625: Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is this limited to administrators or highly privileged users?

What is the immediate remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is this limited to administrators or highly privileged users?

What is the immediate remediation?