CVE-2026-109667

Deferred Deferred - Pending Action

Privilege Escalation in Frappe ERPNext

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109667

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.111.0 and 16.x before 16.22.0 have a privilege escalation flaw in a record-creation endpoint. The vulnerability allows any authenticated user, even without operational roles, to create privileged records by specifying a privileged record type. This bypasses normal permission checks, enabling full site control.

Impact Analysis

An attacker could exploit this to create admin accounts, modify or delete data, and gain complete control over the ERPNext system. This could lead to data breaches, unauthorized access to sensitive information, and disruption of business operations.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face legal penalties, loss of compliance certifications, and reputational damage.

Mitigation Strategies

Immediately upgrade Frappe ERPNext to version 15.111.0 or later if using 15.x, or to 16.22.0 or later if using 16.x. Review all recently created accounts and remove any unauthorized privileged accounts. Monitor system logs for suspicious record creation activities.

Hi! I’m here to help you understand CVE-2026-109667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70