CVE-2026-109628: Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Q: Which deployments are affected?

Affected releases are ERPNext versions before 15.121.0 and 16.x versions before 16.34.0.

Q: What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

Q: What is the impact of successful exploitation?

A low-privileged user can modify record status through endpoints that do not correctly enforce role checks. The stated impact is unauthorized data alteration, affecting integrity rather than confidentiality or availability.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

Affected Software

1 affected component

Frappe ERPNext<15.121.0, >=16.0.0<16.34.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected releases are ERPNext versions before 15.121.0 and 16.x versions before 16.34.0.

What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

What is the impact of successful exploitation?

A low-privileged user can modify record status through endpoints that do not correctly enforce role checks. The stated impact is unauthorized data alteration, affecting integrity rather than confidentiality or availability.

CVE-2026-109628: Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the impact of successful exploitation?