CVE-2026-109641 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within Frappe ERPNext, specifically affecting versions prior to 15.110.0 and 16.x prior to 16.21.0. This vulnerability is classified as a missing authorization issue where the application fails to enforce proper permission checks on specific API endpoints or server-side functions. In a properly secured enterprise resource planning system, every action that modifies data or exposes sensitive information must be validated against the current user's permissions and role-based access controls. However, in these affected versions, certain endpoints operate without verifying whether the requesting entity possesses the necessary privileges to perform the operation. This architectural oversight allows unauthenticated remote attackers to interact with the application directly through HTTP requests, bypassing the standard authentication and authorization layers that are typically required for administrative or privileged actions.
The operational impact of this vulnerability is severe due to its ability to circumvent feature-level restrictions configured by system administrators. Even when an administrator has explicitly disabled a specific module or feature within the ERPNext interface, the underlying API endpoints associated with that feature remain accessible and functional without adequate protection. This discrepancy between the user interface configuration and the backend security logic creates a significant attack surface. Attackers can exploit this gap to create unauthorized records in the database, effectively injecting data into systems where such actions should be prohibited. Furthermore, the vulnerability enables enumeration attacks, allowing adversaries to probe the system for available resources or functional capabilities that are ostensibly hidden from users. This capability undermines the principle of least privilege and compromises the integrity of the application's security model by treating disabled features as non-existent rather than merely inaccessible.
From a technical perspective, this flaw aligns with CWE-285 Improper Authorization, where an actor is able to access or perform functions that they should not be allowed to do. The ability for unauthenticated users to create records and enumerate availability also touches upon CWE-200 Information Exposure and CWE-798 Use of Hard-coded Credentials if the endpoints rely on predictable paths rather than dynamic token validation. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1136.001 Internal Account Creation, as attackers can establish new records or accounts without valid credentials. Additionally, the enumeration aspect relates to reconnaissance activities where adversaries gather information about system capabilities to plan further exploitation steps. The lack of authorization checks on these endpoints means that standard web application firewalls may not detect the malicious activity if it mimics legitimate traffic patterns for enabled features.
Mitigation strategies must prioritize immediate patching and rigorous validation of access control logic across all API layers. Administrators should upgrade Frappe ERPNext to version 15.110.0 or later, which includes fixes that enforce authorization checks consistently regardless of feature toggles in the user interface. Until patches are applied, organizations can implement compensating controls such as network-level restrictions using firewalls to block direct access to sensitive API endpoints from untrusted networks. Additionally, deploying a Web Application Firewall with rules specifically targeting unauthorized creation requests on known vulnerable paths can provide an additional layer of defense. It is also critical for development teams to conduct thorough code reviews focusing on authorization middleware and decorators to ensure that every endpoint validates user permissions before executing business logic. Regular security audits should include testing disabled features to verify that their underlying APIs are indeed inaccessible, ensuring alignment between configuration settings and actual system behavior.