CVE-2026-109622

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Authenticated users can modify data beyond their assigned role permissions. An attacker only needs basic user account access over the network to send requests to vulnerable endpoints.

Root cause

Certain API endpoints fail to enforce authorization checks against user roles before processing document modification requests.

Affected systems

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade Frappe ERPNext to version 15.121.0 or 16.34.0 depending on your release branch. No interim workarounds are listed, so restrict or audit low-privilege user access until patched.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising data integrity.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109622