CVE-2026-109643 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.111.0 and version 16.x prior to 16.22.0. This vulnerability is classified as a broken access control issue where certain project-related API endpoints fail to enforce proper authorization checks before processing requests. In a secure implementation of the principle of least privilege, every request directed at sensitive resources must be validated against the user's assigned roles and permissions to ensure they are authorized for that specific action or data retrieval. However, in these affected versions, the server-side logic omits this critical verification step for particular endpoints associated with project management features. This architectural oversight allows authenticated users who possess low-privileged accounts to bypass intended restrictions by directly invoking these unprotected API routes.
The operational impact of this vulnerability is significant as it enables unauthorized data disclosure. An attacker possessing a standard, low-level user account can exploit the missing authorization mechanism to access sensitive project information that should be restricted to higher-ranking personnel or specific roles such as managers or administrators. This includes details regarding project timelines, budgets, task assignments, and potentially confidential client information embedded within project records. The ability of an unprivileged user to read this data violates confidentiality requirements and can lead to competitive intelligence leaks, internal policy violations, or further exploitation if the exposed data contains credentials or other sensitive artifacts.
From a technical perspective, this flaw aligns with CWE-284 Improper Access Control, specifically illustrating a failure in enforcing access control restrictions on resources for unauthorized actors. The vulnerability is also consistent with MITRE ATT&CK technique T1078 Valid Accounts, where an adversary uses legitimate credentials to gain initial access and then leverages privilege escalation or lateral movement techniques, such as accessing restricted data via API endpoints that lack proper validation. In the context of ERP systems like Frappe, which often handle critical business operations, the integrity of role-based access control is paramount for maintaining organizational security posture.
To mitigate this vulnerability, organizations running affected versions must upgrade to version 15.111.0 or later, or version 16.22.0 and above where these authorization checks have been properly implemented by the vendor. Until an upgrade can be performed, administrators should consider implementing a Web Application Firewall rule set that restricts direct access to known vulnerable endpoints for low-privileged user groups, although this is only a compensatory measure and not a complete fix. Additionally, security teams should audit their API usage logs to identify any potential exploitation attempts where unusual data retrieval patterns are observed from standard user accounts. Regular penetration testing focused on role-based access control weaknesses in custom or core modules can help detect similar misconfigurations before they lead to significant data breaches.