CVE-2026-109644

Deferred Deferred - Pending Action

Frappe ERPNext Missing Authorization in Valuation Data

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109644

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Frappe ERPNext before versions 15.119.0 and 16.x before 16.31.0 has a missing authorization vulnerability in certain endpoints. These endpoints fail to enforce proper authorization checks on valuation data, allowing authenticated low-privileged users to read valuation information beyond their assigned role permissions.

Detection Guidance

To detect this vulnerability, review Frappe ERPNext logs for unauthorized access attempts to valuation endpoints. Check for unusual queries or data exfiltration by low-privileged users. No specific commands are provided in the context.

Impact Analysis

Authenticated low-privileged users could access sensitive valuation data they are not authorized to view. This may lead to unauthorized disclosure of financial or operational information, potential data leaks, or misuse of internal metrics.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to improper data exposure.

Mitigation Strategies

Immediately update Frappe ERPNext to version 15.119.0 or later for v15.x, or 16.31.0 or later for v16.x. Ensure proper authorization checks are enforced on all endpoints handling valuation data.

Hi! I’m here to help you understand CVE-2026-109644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70