CVE-2026-109672

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Authenticated attackers can view unauthorized financial records across the system. They only need low-privileged user access to query the vulnerable endpoints directly.

Root cause

Certain API endpoints fail to perform authorization and role checks before returning financial data.

Affected systems

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Frappe ERPNext to 15.118.0, 16.27.0, or newer. No interim mitigation is documented; restrict untrusted user access until upgraded.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109672