CVE-2026-109637: Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ERPNext user can exploit it. The user needs only low-level privileges and network access to the affected application endpoints.
What is the impact of successful exploitation?
An attacker can modify master data records beyond the permissions assigned to their role. The provided information indicates integrity impact only; no confidentiality or availability impact is stated.
Which versions need remediation?
ERPNext versions before 16.14.0 are affected. Upgrading to 16.14.0 or later addresses the affected version range described.
How can teams assess potential exposure?
Review access and request activity for the affected master-data endpoints, especially changes made by low-privilege accounts that would not normally have authorization to modify those records. The supplied information does not identify the specific endpoints or log indicators.