CVE-2026-109635 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within Frappe ERPNext versions prior to 15.105.0 and the 16.x series before version 16.15.0. This vulnerability is classified as an Insecure Direct Object Reference or, more accurately given the context of portal users acting on behalf of other entities, a Broken Access Control issue where the application fails to enforce proper authorization policies during document creation operations. The core technical deficiency lies in the backend logic handling specific endpoints responsible for generating new records within the system's database structure. When an authenticated user interacts with these portals or interfaces, the server processes the request based on the provided input parameters without sufficiently validating that the identity of the requesting user is legitimately associated with the target party or organization specified in the document metadata. This absence of a strict ownership verification step allows for unauthorized data manipulation and creation activities that bypass intended security boundaries.
From an operational perspective, this vulnerability enables authenticated portal users to perform actions outside their designated scope of authority. Specifically, attackers can exploit these endpoints to create documents such as invoices, sales orders, purchase receipts, or other business-critical records under the identity of a different party within the ERP system. This capability fundamentally undermines the integrity and confidentiality of multi-tenant environments where distinct organizations share the same instance but expect strict data isolation. The ability to forge documents on behalf of another entity can lead to severe financial discrepancies, legal liabilities due to fraudulent documentation, and corruption of business intelligence derived from inaccurate records. In scenarios involving supply chain management or customer relationship management modules, this could result in unauthorized commitments being made by competitors or unrelated entities, causing significant reputational damage and operational disruption for the affected organizations.
The technical nature of this flaw aligns with CWE-269, which describes Improper Privilege Management, specifically focusing on the failure to verify user permissions before executing sensitive operations. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate credentials but abuses them to perform unauthorized actions typical of privilege escalation or lateral movement within an application layer context. The vulnerability highlights a common architectural oversight in web applications where session management and identity verification are decoupled from business logic validation during data mutation events. Developers often assume that because a user is authenticated, their subsequent requests are implicitly authorized for all visible fields; however, this assumption fails when the request explicitly targets resources belonging to other tenants or users without explicit permission checks.
Mitigation strategies must prioritize immediate patching of the affected software versions to 15.105.0 or later for version 15.x branches, and 16.15.0 or later for version 16.x branches. These updates contain the necessary code corrections that enforce strict ownership checks during document creation workflows. For organizations unable to patch immediately due to compatibility constraints with custom apps or plugins, temporary mitigations should include implementing a Web Application Firewall rule set designed to detect anomalous patterns in API requests where user IDs do not match tenant identifiers. Additionally, auditing logs for unusual spikes in document creation across different parties can help identify ongoing exploitation attempts. Long-term remediation requires adopting a defense-in-depth approach that includes rigorous unit testing of authorization logic and integrating static application security testing tools into the continuous integration pipeline to catch such access control failures before deployment.