CVE-2026-109623 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.121.1 and version 16.x prior to 16.34.2. This vulnerability is classified as an Insecure Direct Object Reference or Broken Access Control issue, where the application logic fails to validate whether the authenticated user possesses the necessary permissions to perform specific actions on targeted resources. The core technical deficiency lies in the endpoint handlers which accept requests from users who have successfully logged into the system but do not rigorously check if their assigned role grants them authorization for the requested operation. This oversight allows an attacker, even with minimal privileges such as a standard user account, to bypass intended security boundaries and interact with data objects that should be restricted to administrators or specific functional roles.
From a technical perspective, this vulnerability enables authenticated attackers to modify documents and underlying database records in ways that are explicitly prohibited by the system's role-based access control policies. By crafting malicious HTTP requests directed at these vulnerable endpoints, an attacker can alter critical business information, delete essential records, or inject unauthorized data into the ERP environment. The impact is severe because it undermines the integrity of the enterprise resource planning system, potentially leading to financial discrepancies, operational disruptions, and compliance violations depending on the nature of the modified data. Since the attack requires authentication, it targets insider threats or compromised user credentials rather than unauthenticated external actors, making social engineering or credential theft a likely precursor vector for exploitation.
This flaw aligns with CWE-269, which describes Improper Privilege Management, and falls under MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate system access to perform unauthorized actions. The lack of proper authorization checks means that the principle of least privilege is not enforced at the application logic level for these specific endpoints. To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.121.1 or later, or specifically to version 16.34.2 and above where the authorization checks have been corrected. In addition to patching, administrators should review audit logs for any signs of unauthorized data modifications during the window when the vulnerability was present. Implementing strict input validation and ensuring that all API endpoints enforce role-based access control at every stage of request processing is essential to prevent similar vulnerabilities in future development cycles.