CVE-2026-109655 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.115.0 and version 16.x prior to 16.26.0. This vulnerability stems from an improper implementation of role-based authorization checks on specific application endpoints. In a properly secured enterprise resource planning system, every action that modifies data must be validated against the permissions associated with the authenticated user's role. However, in this instance, certain API endpoints and web interfaces fail to perform these necessary validations before processing requests. This architectural oversight allows any authenticated user, regardless of their assigned privilege level or departmental scope, to interact directly with backend logic intended for higher-privileged administrators or specialized inventory managers.
From a technical perspective, the core issue is classified as an insecure direct object reference combined with broken access control. When a low-privileged user sends a request to modify inventory records, the server processes the command without verifying whether that specific role has been granted write permissions for those particular data objects. This bypasses the intended security boundary between different levels of system users. The vulnerability is particularly dangerous because it does not require complex exploitation techniques or external dependencies; an attacker simply needs valid credentials and basic knowledge of the API structure to send crafted HTTP requests that alter stock levels, item details, or warehouse allocations.
The operational impact of this vulnerability is severe for organizations relying on ERPNext for supply chain management and financial tracking. Inventory data serves as a foundational element for procurement planning, sales fulfillment, and financial auditing. Unauthorized modifications can lead to significant discrepancies in stock counts, potentially causing overselling of items that do not exist or underestimating available resources. This disruption can halt business operations, trigger unnecessary purchase orders based on false low-stock alerts, or result in substantial financial losses due to inaccurate inventory valuation. Furthermore, the ability to alter records without detection undermines the integrity of audit trails, making it difficult for compliance officers and internal auditors to trace who made changes and when, thereby violating principles of non-repudiation and accountability required by many industry standards.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-269, which describes Improper Privilege Management, as well as CWE-862, Missing Authorization. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1496 Resource Hijacking if used for malicious operational disruption, though it is primarily a data integrity threat rather than a resource consumption attack. The lack of enforcement allows an attacker to escalate their effective privileges within the application logic without gaining higher-level system access, effectively bypassing the principle of least privilege that should govern all user interactions with sensitive business data.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.115.0 or later for the v15 branch, and version 16.26.0 or later for the v16 branch. These releases contain patches that enforce strict role-based access controls on all inventory-related endpoints. Until an upgrade is feasible, administrators should implement network-level restrictions to limit exposure of these specific API routes to trusted internal networks only. Additionally, enabling comprehensive logging and monitoring for inventory modification events can help detect unauthorized attempts in real-time. It is also advisable to conduct a thorough review of custom applications or scripts that interact with the ERPNext API to ensure they adhere to strict permission checks on the client side as an additional layer of defense, although server-side validation remains the primary control mechanism required by security best practices.