CVE-2026-109671

Deferred Deferred - Pending Action

Stored XSS in Frappe ERPNext Profile Field

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109671

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	0
frappe	erpnext	16.0.0-beta.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Frappe ERPNext versions before 15.113.0 and 16.x before 16.24.0 have a stored cross-site scripting (XSS) vulnerability in a profile field. This field is rendered without proper escaping on portal pages. Attackers with low privileges can inject malicious scripts into this field, which then execute in the browser of any administrator viewing those pages. This can lead to administrator account takeover.

Detection Guidance

Check Frappe ERPNext versions for affected releases (before 15.113.0 or 16.x before 16.24.0). Inspect profile fields in portal pages for stored scripts. Review browser console logs for XSS errors when viewing user profiles.

Impact Analysis

If you are an administrator using Frappe ERPNext, attackers could take over your account by exploiting this vulnerability. This could allow them to access sensitive data, perform unauthorized actions, or impersonate you within the system. Users with low privileges could also exploit this to escalate their access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance. GDPR requires protection of personal data, and HIPAA mandates safeguards for health information. A successful exploit could result in data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.113.0 or later, or 16.24.0 or later. Sanitize user input in profile fields to prevent script injection. Restrict admin access to portal pages until patched.

Hi! I’m here to help you understand CVE-2026-109671. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70