CVE-2026-109664: Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and hold a common operational role. No user interaction is required, and the vulnerable endpoints can be reached over the network.
What is the practical impact?
A user with the affected role can modify a field on record types that are outside that role's intended permissions. This can result in unauthorized data tampering, but the provided information does not indicate confidentiality disclosure or service disruption.
Which versions need remediation?
ERPNext versions before 15.112.0 are affected. Upgrade to version 15.112.0 or later.
What can be done if an upgrade cannot happen immediately?
Restrict assignment of the common operational role to only trusted users and review users holding that role. Monitor and audit changes to record types that those users should not normally be able to modify.