CVE-2026-109654
Deferred Deferred - Pending Action

Frappe ERPNext Missing Authorization in Transactional Email

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109654

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe erpnext 0
frappe erpnext 16.0.0-beta.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe ERPNext before versions 15.119.0 and 16.x before 16.31.0 has a missing authorization vulnerability. Certain endpoints do not check if the user is allowed to read a document before sending transactional emails about it. Authenticated attackers can exploit this to trigger emails for documents they should not access.

Impact Analysis

An attacker could access sensitive information by receiving transactional emails about documents they are not authorized to view. This may lead to data leaks, unauthorized notifications, or exposure of confidential details depending on the system's use.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive information to unauthorized users. It undermines access control requirements and may lead to compliance breaches, fines, or legal consequences.

Mitigation Strategies

Update Frappe ERPNext to version 15.119.0 or later if using version 15.x, or to version 16.31.0 or later if using version 16.x. This addresses the missing authorization vulnerability by ensuring proper access checks before sending transactional emails.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart