CVE-2026-109656: Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments run Frappe ERPNext before 15.118.2, or a 16.x release before 16.30.0. The issue concerns endpoints that expose item master data without enforcing the intended authorization checks.
What does an attacker need to exploit this issue?
An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required, and the vulnerable endpoints can be reached over the network.
What can an attacker access?
A low-privileged authenticated user may read item master data beyond what their assigned role permits. The provided data indicates confidentiality impact only; it does not identify integrity or availability impact.
How can I determine whether I may be exposed?
Verify the ERPNext version and identify whether it is earlier than 15.118.2 or, for 16.x deployments, earlier than 16.30.0. Review access logs for calls to item master data endpoints made by low-privileged accounts, especially where returned data exceeds the caller's normal role permissions.