CVE-2026-109637

Deferred Deferred - Pending Action

Frappe ERPNext Missing Authorization in Master Data

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109637

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe ERPNext before version 16.14.0 has a missing authorization vulnerability. This allows authenticated users to modify master data beyond their assigned role permissions. Attackers can exploit this by sending requests to specific endpoints that lack proper authorization checks, enabling unauthorized changes to master data records.

Detection Guidance

Check ERPNext logs for unauthorized API requests to master data endpoints. Monitor for unusual changes in master data records by comparing versions or using audit trails. Review network traffic for requests to endpoints like /api/method/frappe.desk.form.load.getdoc or similar master data modification paths.

Impact Analysis

This vulnerability could allow attackers with authenticated access to alter critical master data, potentially leading to data corruption, unauthorized transactions, or system misuse. It may also enable privilege escalation if combined with other flaws.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data modifications. GDPR requires data integrity and access controls, while HIPAA mandates strict access restrictions for sensitive health data. Unauthorized changes may lead to non-compliance penalties.

Mitigation Strategies

Upgrade Frappe ERPNext to version 16.14.0 or later. Review and restrict user roles to ensure least privilege access. Implement additional authorization checks on sensitive endpoints. Monitor for unauthorized changes and audit user activities regularly.

Hi! I’m here to help you understand CVE-2026-109637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70