CVE-2026-109644: Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data

Q: Which deployments are affected?

ERPNext versions before 15.119.0 are affected, as are 16.x versions before 16.31.0.

Q: What level of access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required.

Q: What information could be exposed?

A low-privileged authenticated user may query affected endpoints to read valuation data outside the permissions granted by their assigned role.

Q: What should teams do to remediate the issue?

Upgrade ERPNext to 15.119.0 or later in the 15.x line, or to 16.31.0 or later in the 16.x line.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.119.0, <16.31.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.119.0 are affected, as are 16.x versions before 16.31.0.

What level of access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required.

What information could be exposed?

A low-privileged authenticated user may query affected endpoints to read valuation data outside the permissions granted by their assigned role.

What should teams do to remediate the issue?

Upgrade ERPNext to 15.119.0 or later in the 15.x line, or to 16.31.0 or later in the 16.x line.

CVE-2026-109644: Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What information could be exposed?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What information could be exposed?

What should teams do to remediate the issue?