CVE-2026-109659: Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.113.0 are affected, as are 16.x versions before 16.24.0.
What does an attacker need to exploit this issue?
The attacker must be authenticated to ERPNext. No additional privileges or user interaction are required, but the attacker can only exploit endpoints that lack the required permission checks.
What is the impact of successful exploitation?
An authenticated user may read financial data that their assigned ERPNext role should not permit them to access. The provided severity vector indicates confidentiality impact without integrity or availability impact.
What should be done if affected?
Update ERPNext to 15.113.0 or later for the 15.x branch, or to 16.24.0 or later for the 16.x branch. The provided information does not identify a workaround for systems that cannot be patched immediately.