CVE-2026-109599 in Frappe
Summary
by MITRE • 10/13/2026
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe framework, specifically affecting versions prior to 15.113.3 and version 16.x prior to 16.25.0. This vulnerability is classified as a Broken Access Control issue, which corresponds directly to CWE-284 in the Common Weakness Enumeration standard. The core technical deficiency involves the absence of rigorous authorization checks on specific application endpoints. While the system correctly authenticates users and assigns them roles with defined permissions, it fails to validate whether those authenticated sessions possess the necessary privileges to execute actions or access data associated with particular resources. This gap allows any user who has successfully logged into the application to bypass intended security boundaries by directly interacting with these unprotected API routes or web endpoints.
From an operational perspective, this vulnerability enables unauthorized modification of records that should be restricted based on the user's assigned role. An attacker leveraging this flaw does not need elevated privileges initially; they only require a valid account within the system. By crafting specific HTTP requests to the vulnerable endpoints, the attacker can alter data belonging to other users or modify critical configuration settings beyond their authorized scope. This represents a significant risk to data integrity and confidentiality, as it undermines the principle of least privilege that is fundamental to secure application design. The impact extends beyond simple data corruption; in enterprise environments using Frappe for ERP or CRM operations, such unauthorized changes can lead to financial discrepancies, compromised customer information, and operational disruptions that are difficult to trace back to a specific individual without robust audit logging mechanisms.
This type of vulnerability aligns with the MITRE ATT&CK technique T1078, which covers Valid Accounts, as well as aspects of privilege escalation where an actor uses existing access to perform actions they should not be permitted to do. The exploitation typically involves identifying endpoints that handle data modification operations and manipulating parameters such as document IDs or status fields in POST or PUT requests. Since the framework does not enforce server-side authorization checks for these specific paths, the application processes the request as if it were coming from a user with higher privileges than they actually possess. This lack of enforcement creates an opportunity for horizontal privilege escalation among peers and potentially vertical privilege escalation depending on how roles are structured within the instance.
To mitigate this vulnerability, organizations must upgrade their Frappe instances to version 15.113.3 or later, or version 16.25.0 and above, where these authorization checks have been properly implemented by the developers. Until an upgrade is feasible, administrators should implement compensating controls such as web application firewall rules that restrict access to known vulnerable endpoints based on IP reputation or request patterns. Additionally, it is crucial to review custom apps built on top of Frappe to ensure they do not expose similar unprotected routes. Regular security audits and penetration testing focused on access control logic are recommended to identify any other potential gaps in authorization enforcement across the application surface area.