CVE-2026-109614

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Authenticated users can access and view sensitive financial records beyond their assigned role permissions. Attackers only need basic login credentials with network access to the ERPNext instance.

Root cause

Specific financial data endpoints lack proper authorization checks to restrict access based on user roles.

Affected systems

Frappe ERPNext versions prior to 16.34.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Frappe ERPNext to version 16.34.0 or later. If patching immediately is not possible, restrict untrusted user access or network reachability to the ERPNext instance.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109614