CVE-2026-109665: Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Published Oct 12, 2026
·Updated
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.
Affected Software
1 affected component
Frappe ERPNext<15.108.0, >=16.0.0<16.18.0
Event History
Oct 12, 2026
CVE Published
via MITRE·10:22 PM
Data Sourced
via MITRE·10:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
ERPNext versions before 15.108.0 are affected, as are 16.x versions before 16.18.0.
2
What access does an attacker need?
An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required.
3
What can a successful attacker do?
They can invoke affected endpoints to deactivate master records, modifying data beyond the permissions assigned to their role.
4
Does this vulnerability affect confidentiality or availability?
The provided impact assessment indicates integrity impact only. It does not indicate confidentiality or availability impact.