CVE-2026-109645: Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.119.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.31.0
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.119.0 are affected, as are 16.x versions before 16.31.0.
Does exploitation require an existing account?
Yes. An attacker must be authenticated and have at least low-level privileges to send requests to the affected endpoints.
What can an attacker do if they exploit this issue?
They can create records and modify data beyond the permissions assigned to their role, bypassing intended role-based access restrictions.
What is the remediation?
Upgrade ERPNext to 15.119.0 or later in the 15.x line, or to 16.31.0 or later in the 16.x line.