CVE-2026-109650 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.112.0 and version 16.x prior to 16.23.0. This vulnerability stems from an improper implementation of authorization checks on specific API endpoints designed for data retrieval or manipulation. In a properly secured enterprise resource planning system, every request must be validated against the user's assigned roles and permissions before any sensitive operation is executed. However, in these affected versions, certain endpoints operate without verifying whether the authenticated user possesses the requisite privileges to access the targeted resources. This architectural oversight allows for unauthorized data exposure that bypasses standard role-based access control protocols.
The technical nature of this flaw aligns with CWE-284, which classifies Improper Access Control as a category where an actor is granted permissions or capabilities they should not have. Furthermore, from a tactical perspective, this vulnerability maps to the MITRE ATT&CK technique T1078, specifically Valid Accounts, and more precisely relates to lateral movement or privilege escalation scenarios where low-privileged users exploit misconfigurations to access restricted information. The core issue is that while authentication successfully verifies the identity of the user, the subsequent authorization step fails to restrict their actions based on their security clearance level. This gap effectively renders the role-based permissions model ineffective for the affected endpoints, creating a significant blind spot in the application's security posture.
The operational impact of this vulnerability is severe due to the nature of ERPNext as a comprehensive business management suite that handles sensitive corporate and personal data. Authenticated users with low-privileged roles, such as standard employees or junior staff members who typically have limited access rights, can exploit these endpoints to read personal data belonging to other users or confidential organizational information. This includes potentially accessing employee records, financial details, customer contact information, or internal communications that are strictly reserved for administrators or specific managerial roles. The ability of low-privileged actors to exfiltrate this data constitutes a direct violation of confidentiality principles and can lead to significant privacy breaches under regulations such as GDPR or CCPA, depending on the jurisdiction and nature of the stored data.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.112.0 or later for the v15 branch, or version 16.23.0 or later for the v16 branch. These releases contain patches that enforce proper authorization checks on the previously vulnerable endpoints. In addition to upgrading, security teams should conduct a thorough audit of custom applications and scripts integrated with ERPNext to ensure they do not rely on any deprecated API behaviors that might bypass current controls. Implementing strict input validation and ensuring that all backend services explicitly check user permissions before processing requests is essential for maintaining robust access control. Regular penetration testing focused on authorization flaws can further help identify similar misconfigurations in custom modules or third-party integrations, thereby strengthening the overall security resilience of the ERP environment against unauthorized data access attempts.