CVE-2026-109630: Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.
What access does an attacker need?
An attacker must be authenticated with a valid ERPNext account. No user interaction is required, and the vulnerable endpoints can be reached over the network.
What is the likely impact?
An authenticated user may read data that exceeds the permissions assigned to their role. The provided information does not indicate integrity or availability impact.
What should be prioritized for remediation?
Upgrade ERPNext to 15.121.0 or later on the 15.x branch, or to 16.34.0 or later on the 16.x branch. Until upgrading, restrict access for lower-privileged accounts where possible because exploitation requires authentication.