CVE-2026-109656: Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Q: Which deployments are affected?

Affected deployments run Frappe ERPNext before 15.118.2, or a 16.x release before 16.30.0. The issue concerns endpoints that expose item master data without enforcing the intended authorization checks.

Q: What does an attacker need to exploit this issue?

An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required, and the vulnerable endpoints can be reached over the network.

Q: What can an attacker access?

A low-privileged authenticated user may read item master data beyond what their assigned role permits. The provided data indicates confidentiality impact only; it does not identify integrity or availability impact.

Q: How can I determine whether I may be exposed?

Verify the ERPNext version and identify whether it is earlier than 15.118.2 or, for 16.x deployments, earlier than 16.30.0. Review access logs for calls to item master data endpoints made by low-privileged accounts, especially where returned data exceeds the caller's normal role permissions.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.

Affected Software

1 affected component

Frappe ERPNext<15.118.2, <16.30.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments run Frappe ERPNext before 15.118.2, or a 16.x release before 16.30.0. The issue concerns endpoints that expose item master data without enforcing the intended authorization checks.

What does an attacker need to exploit this issue?

An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required, and the vulnerable endpoints can be reached over the network.

What can an attacker access?

A low-privileged authenticated user may read item master data beyond what their assigned role permits. The provided data indicates confidentiality impact only; it does not identify integrity or availability impact.

How can I determine whether I may be exposed?

Verify the ERPNext version and identify whether it is earlier than 15.118.2 or, for 16.x deployments, earlier than 16.30.0. Review access logs for calls to item master data endpoints made by low-privileged accounts, especially where returned data exceeds the caller's normal role permissions.

CVE-2026-109656: Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What can an attacker access?

How can I determine whether I may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What can an attacker access?

How can I determine whether I may be exposed?