CVE-2026-109628

Deferred Deferred - Pending Action

Authorization Bypass in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109628

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 have a missing authorization vulnerability. Certain endpoints do not enforce proper role checks when modifying record status. This allows authenticated low-privileged attackers to alter data beyond their permitted role, compromising data integrity.

Impact Analysis

Authenticated low-privileged attackers could modify data they are not authorized to change, leading to unauthorized alterations in records. This could result in incorrect data, financial discrepancies, or other integrity issues within the ERPNext system.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, loss of trust, and potential data breaches if sensitive information is altered without authorization.

Mitigation Strategies

Update Frappe ERPNext to version 15.121.0 or later for v15.x, or 16.34.0 or later for v16.x to address the missing authorization vulnerability.

Hi! I’m here to help you understand CVE-2026-109628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70