CVE-2026-109666: Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are ERPNext releases before 15.110.0 and 16.x releases before 16.21.0. The issue concerns certain endpoints that handle inventory records.
What does an attacker need to exploit this issue?
An attacker needs to be authenticated. They can then send requests to the affected endpoints to modify inventory data beyond the permissions assigned to their role.
Are unauthenticated users able to exploit the vulnerability?
The available information describes exploitation by authenticated users, not unauthenticated users. The vulnerability is therefore relevant where users with limited roles can access the affected ERPNext instance.