CVE-2026-109661: Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.116.0 are affected, as are 16.x versions before 16.27.0. Deployments on the listed fixed versions or later within those release lines are not described as affected.
Does exploitation require an unauthenticated attacker or user interaction?
No. Exploitation requires an authenticated account with low privileges, and no user interaction is required.
What is the impact of successful exploitation?
A low-privileged authenticated user can query certain insufficiently protected endpoints and read financial data outside the permissions of their assigned role. The provided information describes confidentiality impact, not modification or availability impact.
What should teams prioritize when patching cannot happen immediately?
Prioritize limiting access for low-privileged accounts, since those accounts can be used to query the affected endpoints. Review which users have authenticated access and their ability to reach ERPNext endpoints that expose financial data.