CVE-2026-109659: Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

Q: Which deployments are affected?

ERPNext versions before 15.113.0 are affected, as are 16.x versions before 16.24.0.

Q: What does an attacker need to exploit this issue?

The attacker must be authenticated to ERPNext. No additional privileges or user interaction are required, but the attacker can only exploit endpoints that lack the required permission checks.

Q: What is the impact of successful exploitation?

An authenticated user may read financial data that their assigned ERPNext role should not permit them to access. The provided severity vector indicates confidentiality impact without integrity or availability impact.

Q: What should be done if affected?

Update ERPNext to 15.113.0 or later for the 15.x branch, or to 16.24.0 or later for the 16.x branch. The provided information does not identify a workaround for systems that cannot be patched immediately.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.113.0, <16.24.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.113.0 are affected, as are 16.x versions before 16.24.0.

What does an attacker need to exploit this issue?

The attacker must be authenticated to ERPNext. No additional privileges or user interaction are required, but the attacker can only exploit endpoints that lack the required permission checks.

What is the impact of successful exploitation?

An authenticated user may read financial data that their assigned ERPNext role should not permit them to access. The provided severity vector indicates confidentiality impact without integrity or availability impact.

What should be done if affected?

Update ERPNext to 15.113.0 or later for the 15.x branch, or to 16.24.0 or later for the 16.x branch. The provided information does not identify a workaround for systems that cannot be patched immediately.

CVE-2026-109659: Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be done if affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

What should be done if affected?