CVE-2026-109669: Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 15.110.0 - Upgrade
Upgrade
Frappe ERPNextto a version that resolves this vulnerability.Fixed in 16.21.0
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0.
What does an attacker need to exploit this issue?
An attacker needs an authenticated account with low privileges. No user interaction is required, and the vulnerable endpoints are reachable over the network.
What can a successful attacker do?
A low-privileged authenticated user can modify record status data beyond the permissions assigned to their role, bypassing intended role-based access restrictions.