CVE-2026-109665: Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Q: Which deployments are affected?

ERPNext versions before 15.108.0 are affected, as are 16.x versions before 16.18.0.

Q: What access does an attacker need?

An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required.

Q: What can a successful attacker do?

They can invoke affected endpoints to deactivate master records, modifying data beyond the permissions assigned to their role.

Q: Does this vulnerability affect confidentiality or availability?

The provided impact assessment indicates integrity impact only. It does not indicate confidentiality or availability impact.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.

Affected Software

1 affected component

Frappe ERPNext<15.108.0, >=16.0.0<16.18.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.108.0 are affected, as are 16.x versions before 16.18.0.

What access does an attacker need?

An attacker needs an authenticated low-privileged ERPNext account. No user interaction is required.

What can a successful attacker do?

They can invoke affected endpoints to deactivate master records, modifying data beyond the permissions assigned to their role.

Does this vulnerability affect confidentiality or availability?

The provided impact assessment indicates integrity impact only. It does not indicate confidentiality or availability impact.

CVE-2026-109665: Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can a successful attacker do?

Does this vulnerability affect confidentiality or availability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What can a successful attacker do?

Does this vulnerability affect confidentiality or availability?