CVE-2026-109662

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can hijack staff browser sessions or perform actions on their behalf when staff view submitted portal records. They only need network access to submit a crafted payload to the public portal form.

Root cause

A public portal form accepts unauthenticated input and stores it without proper sanitization, rendering malicious markup in reviewers' browsers.

Affected systems

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade ERPNext to 15.112.0, 16.23.0, or newer. If patching must wait, restrict access to or disable unauthenticated public portal form submissions.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109662