CVE-2026-109650: Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0.
What does an attacker need to exploit this issue?
The attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.
What is the impact of successful exploitation?
A low-privileged user may read personal data that their assigned ERPNext role should not allow them to access. The provided information identifies confidentiality impact only; it does not indicate integrity or availability impact.