CVE-2026-109629 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a critical failure in access control mechanisms within Frappe ERPNext versions prior to 15.121.3 and 16.x prior to 16.35.0. This flaw specifically affects an endpoint responsible for dispatching transactional emails via the organization's configured outgoing mail account. The core technical deficiency lies in the absence of authorization checks when processing requests sent through this interface. Consequently, any user who has successfully authenticated to the ERPNext system can invoke this functionality without possessing the necessary permissions or privileges typically required for such administrative actions. This lack of enforcement allows unauthorized actors to bypass standard security boundaries that are designed to restrict sensitive operations to specific roles or administrators only.
From a technical perspective, the vulnerability enables an attacker to supply arbitrary recipient lists and message content directly into the email sending mechanism. Because the system does not validate whether the requesting user is authorized to use the configured outgoing account for such purposes, it blindly processes these inputs using the organization's trusted identity. This behavior effectively turns the application into a relay service controlled by any authenticated member of the network. The attacker can leverage this capability to send messages that appear to originate from legitimate organizational sources, thereby exploiting trust relationships established between the company and its external partners or customers.
The operational impact of this vulnerability is significant, primarily centering on reputation damage, phishing potential, and compliance violations. By sending emails under the organization's domain identity, an attacker can conduct sophisticated social engineering attacks that are far more likely to succeed than those sent from personal accounts due to their perceived legitimacy. This could lead to credential harvesting, financial fraud through business email compromise scenarios, or distribution of malware disguised as official correspondence. Furthermore, such misuse may violate data protection regulations like GDPR if sensitive information is inadvertently included in the unauthorized communications, exposing the organization to legal and regulatory consequences.
This issue aligns with CWE-269, which describes Improper Privilege Assignment, specifically highlighting a situation where users are granted privileges they should not have for specific functions. In terms of offensive security frameworks, this vulnerability facilitates actions consistent with ATT&CK technique T1534, known as Internal Spearphishing, where adversaries use internal systems to send malicious emails that appear legitimate to recipients within or outside the organization. The exploitation path relies on initial authentication, making it an insider threat vector or a consequence of compromised credentials rather than an unauthenticated remote code execution flaw.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.121.3 or later for the v15 branch, and version 16.35.0 or later for the v16 branch. These updates include patches that enforce proper authorization checks on the email sending endpoints, ensuring that only users with appropriate permissions can utilize the configured outgoing mail accounts. In addition to upgrading, administrators should review existing user roles and permissions within their ERPNext instance to ensure that access to sensitive features is strictly limited based on the principle of least privilege. Implementing additional monitoring for unusual outbound email patterns can also help detect potential abuse in environments where patch deployment might be delayed.