CVE-2026-109629: Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint

Q: Which deployments are affected?

ERPNext versions before 15.121.3 are affected, as are 16.x versions before 16.35.0. The issue applies where the site has a configured outgoing email account that the transactional email endpoint can use.

Q: What access does an attacker need to exploit this?

An attacker needs an authenticated ERPNext account with low-level user access. No user interaction is required, and the attacker can provide arbitrary recipient lists and message content.

Q: What is the practical impact of exploitation?

An authenticated user can send attacker-controlled emails using the organisation's configured sending identity. This can enable impersonation or phishing and can affect the integrity and reputation of the organisation's email communications.

Q: How can an organisation determine whether it may already be exposed?

Review the deployed ERPNext version and identify sites below 15.121.3 or 16.35.0. Also review transactional email activity from the configured outgoing account for unexpected recipients or message content, particularly messages initiated by ordinary authenticated users.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.

Affected Software

1 affected component

Frappe ERPNext<15.121.3, >=16.0.0<16.35.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 15.121.3
Upgrade
Upgrade Frappe ERPNext to a version that resolves this vulnerability.
Fixed in 16.35.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.121.3 are affected, as are 16.x versions before 16.35.0. The issue applies where the site has a configured outgoing email account that the transactional email endpoint can use.

What access does an attacker need to exploit this?

An attacker needs an authenticated ERPNext account with low-level user access. No user interaction is required, and the attacker can provide arbitrary recipient lists and message content.

What is the practical impact of exploitation?

An authenticated user can send attacker-controlled emails using the organisation's configured sending identity. This can enable impersonation or phishing and can affect the integrity and reputation of the organisation's email communications.

How can an organisation determine whether it may already be exposed?

Review the deployed ERPNext version and identify sites below 15.121.3 or 16.35.0. Also review transactional email activity from the configured outgoing account for unexpected recipients or message content, particularly messages initiated by ordinary authenticated users.

CVE-2026-109629: Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

What is the practical impact of exploitation?

How can an organisation determine whether it may already be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this?

What is the practical impact of exploitation?

How can an organisation determine whether it may already be exposed?