CVE-2026-109635: Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.
Affected Software
Event History
Frequently Asked Questions
Which ERPNext deployments are affected?
Affected versions are ERPNext releases before 15.105.0 and 16.x releases before 16.15.0. The issue concerns certain document-creation endpoints available to authenticated portal users.
What does an attacker need to exploit this issue?
An attacker needs an authenticated portal-user account. They can submit requests to vulnerable document-creation endpoints without needing to belong to the party for which the document is created.
How can the issue be remediated?
Upgrade ERPNext to 15.105.0 or later on the 15.x branch, or to 16.15.0 or later on the 16.x branch.