CVE-2026-109640

Deferred Deferred - Pending Action

Unauthorized Record Modification in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109640

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe ERPNext before version 16.22.0 has a missing authorization vulnerability. This means authenticated users can call certain endpoints that do not have proper checks to verify if they are allowed to perform actions. Attackers can exploit this to modify records they should not have access to, leading to unauthorized data changes.

Impact Analysis

If you use Frappe ERPNext before 16.22.0, an attacker with valid credentials could modify sensitive data like financial records, user permissions, or inventory. This could lead to data corruption, financial loss, or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by allowing unauthorized modifications to personal or health data. GDPR requires strict access controls and data integrity, while HIPAA mandates protection against unauthorized changes to protected health information. Exploitation could result in non-compliance penalties.

Mitigation Strategies

Update Frappe ERPNext to version 16.22.0 or later to address the missing authorization vulnerability. Review and restrict endpoint access to ensure proper authorization checks are in place for all user roles.

Hi! I’m here to help you understand CVE-2026-109640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70