CVE-2026-109627: Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Q: Which deployments are affected?

Frappe ERPNext versions before 15.120.0 are affected, as are 16.x versions before 16.33.0.

Q: What does an attacker need to exploit this issue?

The attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the affected endpoints can be requested directly.

Q: What is the potential impact?

A low-privileged user may read financial data that exceeds the permissions assigned to their role. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.

Q: What is the remediation?

Upgrade ERPNext to 15.120.0 or later on the 15.x release line, or to 16.33.0 or later on the 16.x release line.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.120.0, <16.33.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe ERPNext versions before 15.120.0 are affected, as are 16.x versions before 16.33.0.

What does an attacker need to exploit this issue?

The attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the affected endpoints can be requested directly.

What is the potential impact?

A low-privileged user may read financial data that exceeds the permissions assigned to their role. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.

What is the remediation?

Upgrade ERPNext to 15.120.0 or later on the 15.x release line, or to 16.33.0 or later on the 16.x release line.

CVE-2026-109627: Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

What is the remediation?