CVE-2026-109668: Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0.
What does an attacker need to exploit this issue?
An attacker needs an authenticated low-privileged ERPNext account and network access to send requests to the affected party-record endpoints. No user interaction is required.
What is the impact of successful exploitation?
A low-privileged authenticated user can modify party-record data beyond the permissions granted by their assigned role. The provided severity vector indicates integrity impact only; it does not indicate confidentiality or availability impact.
What should be done if patching cannot happen immediately?
The provided data does not identify a workaround. Limit access for low-privileged accounts as appropriate and review party-record changes for unauthorized modifications until an update can be applied.