CVE-2026-109617 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.121.0 and version 16.x prior to 16.34.0. This vulnerability stems from an insufficient enforcement of authorization checks during the document creation process across specific API endpoints. In a properly secured enterprise resource planning system, every action that modifies data must be validated against the requesting user's assigned roles and permissions. However, in these affected versions, the backend logic fails to verify whether the authenticated user possesses the necessary privileges to create records for certain types of documents or against specific target entities. This oversight allows any authenticated user with low-level privileges to bypass role-based access controls entirely by directly interacting with the vulnerable endpoints.
From a technical perspective, this is classified as an insecure direct object reference combined with broken access control. The application accepts input from users who have only basic permissions and processes requests that should be restricted to administrators or higher-privileged roles. Because the authorization check is missing rather than flawed, there is no conditional logic evaluating user identity against resource ownership or role hierarchy before committing changes to the database. This allows attackers to manipulate internal state by creating documents in modules where they typically have read-only access or no access at all. The vulnerability exploits the trust placed in authenticated sessions without verifying that the session holder has the requisite authority for the specific operation being performed.
The operational impact of this vulnerability is significant, as it undermines the integrity and confidentiality of sensitive business data managed by ERPNext systems. Low-privileged users can inject unauthorized records into critical modules such as financial transactions, human resources data, or inventory management logs. This capability enables malicious insiders to fabricate invoices, alter employee records, or manipulate stock levels without detection through standard audit trails that rely on proper user attribution. Furthermore, this lack of authorization enforcement facilitates privilege escalation scenarios where an attacker can use created documents as a foothold for further exploitation within the application logic. The ability to create arbitrary data points also poses risks related to data integrity and compliance with regulatory standards requiring strict separation of duties.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-269, which covers Improper Privilege Management, specifically regarding insufficient authorization checks during object creation. It is also directly mapped to the MITRE ATT&CK technique T1078, Valid Accounts, as it involves using legitimate credentials to perform actions outside their intended scope. Additionally, aspects of this flaw relate to CWE-284, Improper Access Control, where access control decisions are not enforced before performing security-critical functions. The attack vector is typically remote and requires authentication, placing it within the context of authenticated API abuse rather than unauthenticated injection attacks.
To mitigate this risk, organizations running affected versions must immediately upgrade to Frappe ERPNext version 15.121.0 or later for the v15 branch, or version 16.34.0 and above for the v16 branch. These releases contain patches that enforce rigorous authorization checks on all document creation endpoints. In environments where immediate patching is not feasible due to operational constraints, administrators should implement network-level controls such as Web Application Firewalls configured to detect anomalous patterns of data insertion by low-privileged users. Additionally, enabling comprehensive audit logging and monitoring for unusual activity in restricted modules can help identify potential exploitation attempts. Regular security assessments focusing on role-based access control validation are recommended to ensure that future development cycles adhere to strict authorization protocols before deployment.