CVE-2026-109672: Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.118.0 are affected, as are 16.x versions before 16.27.0. The issue is in certain endpoints that do not properly enforce authorization checks.
What does an attacker need to exploit this issue?
An attacker needs an authenticated ERPNext account. No user interaction is required, and the attacker can use the affected endpoints to read financial data beyond the permissions assigned to their role.
What is the impact of successful exploitation?
Successful exploitation exposes financial data to authenticated users who should not be authorized to view it. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.