CVE-2026-109632: Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints

Q: Which deployments are affected?

ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.33.0.

Q: What does an attacker need to exploit this issue?

The attacker needs to be authenticated to ERPNext. No user interaction is required, and the vulnerable endpoints can be called directly over the network.

Q: What could an attacker access?

An authenticated user may read data that exceeds the permissions granted by their assigned ERPNext role. The provided information indicates confidentiality impact, not integrity or availability impact.

Q: Are unauthenticated users affected?

The described issue requires authentication, so the provided information does not indicate exploitation by unauthenticated users.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.121.0, >=16.0.0<16.33.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.33.0.

What does an attacker need to exploit this issue?

The attacker needs to be authenticated to ERPNext. No user interaction is required, and the vulnerable endpoints can be called directly over the network.

What could an attacker access?

An authenticated user may read data that exceeds the permissions granted by their assigned ERPNext role. The provided information indicates confidentiality impact, not integrity or availability impact.

Are unauthenticated users affected?

The described issue requires authentication, so the provided information does not indicate exploitation by unauthenticated users.

CVE-2026-109632: Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access?

Are unauthenticated users affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker access?

Are unauthenticated users affected?