CVE-2026-109660: Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints

Q: Which deployments are affected?

ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0.

Q: What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

Q: What is the likely impact of exploitation?

A low-privileged user may modify production data beyond the permissions assigned to their role. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.

Q: What should be done if patching cannot happen immediately?

The provided information does not identify a workaround. Restrict access to affected production-record operations to trusted authenticated users and review low-privileged accounts that may be able to reach these endpoints.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.

Affected Software

1 affected component

Frappe ERPNext<15.112.0, >=16.0.0<16.23.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.112.0 are affected, as are 16.x versions before 16.23.0.

What access does an attacker need?

An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints can be reached over the network.

What is the likely impact of exploitation?

A low-privileged user may modify production data beyond the permissions assigned to their role. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.

What should be done if patching cannot happen immediately?

The provided information does not identify a workaround. Restrict access to affected production-record operations to trusted authenticated users and review low-privileged accounts that may be able to reach these endpoints.

CVE-2026-109660: Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the likely impact of exploitation?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What is the likely impact of exploitation?

What should be done if patching cannot happen immediately?