CVE-2026-109655: Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.115.0 are affected, as are 16.x versions before 16.26.0. The issue concerns certain inventory-related endpoints.
What does an attacker need to exploit this issue?
An attacker needs an authenticated ERPNext account with low privileges. No user interaction is required, and the vulnerable endpoints are reachable over the network.
What could a successful attacker do?
A low-privileged authenticated user could modify inventory records beyond the permissions assigned to their role. The provided impact information identifies integrity impact, not confidentiality or availability impact.
What is the remediation?
Upgrade ERPNext 15.x to 15.115.0 or later, or upgrade ERPNext 16.x to 16.26.0 or later.