CVE-2026-109645 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in the implementation of Role-Based Access Control within Frappe ERPNext versions prior to 15.119.0 and 16.x prior to 16.31.0. This vulnerability stems from missing authorization checks on specific API endpoints, which are designed to handle data creation and modification operations. In a properly secured system, every request that alters state or creates new records must be validated against the requesting user's assigned roles and permissions before execution. However, in these affected versions, certain endpoints operate without enforcing this necessary verification step. This architectural oversight allows authenticated users to interact with functionality for which they have not been granted explicit access rights, effectively bypassing the intended security boundaries established by the application administrators.
From a technical perspective, this issue is classified as an Insecure Direct Object Reference or more accurately in this context, Broken Access Control where server-side authorization checks are omitted. The vulnerability specifically impacts endpoints responsible for creating records and modifying existing data structures within the ERP system. Because the authentication mechanism successfully validates that a user has logged into the system, but the subsequent authorization logic fails to verify if that specific user possesses the requisite role or permission level for the requested action, an attacker can exploit this gap. By crafting HTTP requests with appropriate parameters targeting these vulnerable endpoints, an authenticated adversary can execute administrative functions or manipulate sensitive business data without holding the necessary privileges. This type of flaw is particularly dangerous in enterprise resource planning systems where data integrity and segregation of duties are paramount for operational compliance and security.
The operational impact of this vulnerability is severe due to the nature of ERPNext as a central hub for organizational operations including finance, inventory, human resources, and customer relationship management. An attacker with low-level access could potentially escalate their privileges by creating unauthorized records or altering critical data fields. This could lead to financial fraud through manipulation of accounting entries, compromise of employee privacy via alteration of personal information, or disruption of supply chain logistics by modifying inventory levels. Furthermore, the ability to create arbitrary records can be used to inject malicious configurations or backdoors into the system if those endpoints allow for configuration changes. The lack of proper permission checks undermines the principle of least privilege, allowing users to perform actions that should be restricted to higher-level administrators or specialized roles, thereby eroding trust in the system's data integrity and security posture.
This vulnerability aligns with CWE-269 Improper Privilege Management and specifically relates to CWE-862 Missing Authorization, as identified by the Common Weakness Enumeration project. In terms of offensive cybersecurity frameworks, this behavior corresponds to MITRE ATT&CK technique T1078 Valid Accounts, where an attacker leverages legitimate credentials to access resources they are not authorized to use, potentially leading to privilege escalation if combined with other exploits or through lateral movement within the network environment dependent on ERPNext. The exploitation does not require complex binary analysis or memory corruption techniques but relies instead on logical flaws in the application's request handling logic, making it relatively straightforward for any authenticated user with basic knowledge of HTTP protocols and API structures to exploit.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Organizations running affected versions should upgrade Frappe ERPNext to version 15.119.0 or later, or version 16.31.0 and above, where these authorization checks have been implemented correctly by the development team. Until patches can be applied in controlled maintenance windows, administrators should implement compensating controls such as web application firewall rules that restrict access to known vulnerable endpoints based on user role headers if available, although this is less reliable than fixing the code itself. Additionally, rigorous logging and monitoring of API requests for anomalies, particularly those involving high-privilege actions from low-level accounts, can help in detecting exploitation attempts in real-time. Regular security audits focusing on permission matrices and access control lists are recommended to ensure that future development adheres strictly to secure coding standards regarding authorization checks on all state-changing endpoints.