CVE-2026-109651: Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.112.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.23.0
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0. The issue applies where the vulnerable configuration field can be written by common operational roles.
What access does an attacker need to exploit this?
An attacker needs an authenticated ERPNext account with permission to modify the affected configuration field. No user interaction is required after the attacker sets the request destination.
What can an attacker reach through this issue?
The attacker can cause the ERPNext server to make outbound requests to arbitrary destinations they specify. This can expose hosts and addresses that are reachable from the deployment's internal network but not directly reachable by the attacker.