CVE-2026-109654: Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Q: Which deployments require remediation?

ERPNext versions earlier than 15.119.0 are affected, as are 16.x versions earlier than 16.31.0.

Q: Does exploitation require authentication or elevated privileges?

Exploitation requires an authenticated attacker. The provided information does not indicate that administrative privileges are required.

Q: What can an attacker do through the affected endpoints?

An authenticated attacker can trigger transactional email about documents that they are not authorized to read. The documented impact is limited to unauthorized email triggering and associated low confidentiality and integrity impact.

Q: What is the available remediation?

Update ERPNext to 15.119.0 or later in the 15.x line, or to 16.31.0 or later in the 16.x line.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.

Affected Software

1 affected component

Frappe ERPNext<15.119.0, >=16.0.0<16.31.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments require remediation?

ERPNext versions earlier than 15.119.0 are affected, as are 16.x versions earlier than 16.31.0.

Does exploitation require authentication or elevated privileges?

Exploitation requires an authenticated attacker. The provided information does not indicate that administrative privileges are required.

What can an attacker do through the affected endpoints?

An authenticated attacker can trigger transactional email about documents that they are not authorized to read. The documented impact is limited to unauthorized email triggering and associated low confidentiality and integrity impact.

What is the available remediation?

Update ERPNext to 15.119.0 or later in the 15.x line, or to 16.31.0 or later in the 16.x line.

CVE-2026-109654: Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments require remediation?

Does exploitation require authentication or elevated privileges?

What can an attacker do through the affected endpoints?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments require remediation?

Does exploitation require authentication or elevated privileges?

What can an attacker do through the affected endpoints?

What is the available remediation?