CVE-2026-109642: Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Q: Which deployments are affected?

Frappe ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0.

Q: What access does an attacker need?

An attacker must be authenticated as an ERPNext user. No user interaction is required, and the attack can be performed over the network.

Q: What is the likely impact?

An authenticated user may read data from affected endpoints that exceeds the access allowed by their assigned role. The provided information does not indicate an integrity or availability impact.

Q: What should be prioritized for remediation?

Upgrade ERPNext to 15.110.0 or later in the 15.x line, or to 16.21.0 or later in the 16.x line. Prioritize instances where lower-privileged authenticated users can access the application.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.110.0, >=16.0.0<16.21.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0.

What access does an attacker need?

An attacker must be authenticated as an ERPNext user. No user interaction is required, and the attack can be performed over the network.

What is the likely impact?

An authenticated user may read data from affected endpoints that exceeds the access allowed by their assigned role. The provided information does not indicate an integrity or availability impact.

What should be prioritized for remediation?

Upgrade ERPNext to 15.110.0 or later in the 15.x line, or to 16.21.0 or later in the 16.x line. Prioritize instances where lower-privileged authenticated users can access the application.

CVE-2026-109642: Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the likely impact?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the likely impact?

What should be prioritized for remediation?