CVE-2026-109628 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.121.0 and version 16.x prior to 16.34.0. This vulnerability is classified as a missing authorization issue where specific API endpoints fail to enforce adequate role-based access controls during operations that modify record status. In a properly secured system, any action that alters the state of data records must be validated against the permissions associated with the authenticated user's account. However, in these vulnerable versions, the backend logic does not sufficiently verify whether the requesting user possesses the necessary privileges to perform such modifications. This oversight creates a critical gap in the application security model, allowing actions intended for administrators or users with elevated roles to be executed by accounts with significantly lower privilege levels.
From a technical perspective, this vulnerability stems from an improper implementation of access control checks within the framework's request handling mechanism. When a user submits a request to change the status of a record, such as approving a document, changing its workflow state, or marking it as complete, the system fails to cross-reference the action against the user's assigned roles and permissions. This lack of server-side validation means that an attacker who has successfully authenticated with a low-privileged account can directly invoke these endpoints using standard HTTP requests. By manipulating the parameters sent in these requests, the attacker can bypass intended restrictions and force the database into states that should only be accessible to higher-level users. The core issue is not a failure of authentication but rather a complete absence or insufficiency of authorization checks at the point of execution for specific status-modifying operations.
The operational impact of this vulnerability is severe due to its direct effect on data integrity and business logic enforcement. ERPNext systems are often used in enterprise environments where workflow states dictate financial approvals, inventory management, and human resources processes. If an attacker can alter record statuses without proper authorization, they can disrupt these critical workflows. For instance, a low-privileged employee might be able to approve their own expense reports or change the status of procurement orders from pending to approved, effectively bypassing internal controls designed to prevent fraud and errors. This compromise undermines the trustworthiness of the data stored within the system and can lead to significant financial loss, regulatory non-compliance, and operational disruptions. The ability to modify record statuses arbitrarily also allows for potential denial-of-service conditions by placing critical records in invalid or unprocessable states that require manual intervention to resolve.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically the failure of a system to enforce proper authorization checks during privilege escalation scenarios via API endpoints. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials to gain access and then exploit missing permissions to perform unauthorized actions. The exploitation path typically involves authenticated low-privileged users leveraging tools like curl or custom scripts to send crafted requests to the vulnerable endpoints, demonstrating that no complex remote code execution is required for this attack vector.
To mitigate this vulnerability, organizations running Frappe ERPNext must immediately upgrade their instances to version 15.121.0 or later if they are on the v15 branch, or to version 16.34.0 and above if operating on the v16 branch. These releases contain patches that enforce stricter role checks for all record status modification endpoints. In addition to upgrading, administrators should review their custom scripts and integrations to ensure no workarounds have been implemented that might bypass standard permission layers. Implementing additional monitoring through intrusion detection systems can help identify unusual patterns of endpoint access from low-privileged accounts. Regular security audits focusing on role-based access control configurations are also recommended to prevent similar authorization flaws in other parts of the application stack, ensuring that all data modification operations adhere strictly to defined user permissions.