CVE-2026-109650: Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Q: Which deployments are affected?

ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0.

Q: What does an attacker need to exploit this issue?

The attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

Q: What is the impact of successful exploitation?

A low-privileged user may read personal data that their assigned ERPNext role should not allow them to access. The provided information identifies confidentiality impact only; it does not indicate integrity or availability impact.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.112.0, >=16.0.0<16.23.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0.

What does an attacker need to exploit this issue?

The attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

What is the impact of successful exploitation?

A low-privileged user may read personal data that their assigned ERPNext role should not allow them to access. The provided information identifies confidentiality impact only; it does not indicate integrity or availability impact.

CVE-2026-109650: Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?