CVE-2026-109656 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.118.2 and version 16.x prior to 16.30.0. This vulnerability is classified as a broken access control issue where the application fails to enforce proper authorization checks on specific endpoints responsible for handling item master data. In enterprise resource planning systems, item master data constitutes critical business information that includes product details, pricing structures, inventory levels, and supplier relationships. The absence of rigorous validation mechanisms allows authenticated users with low-privileged roles to bypass intended access restrictions. This architectural weakness means that the system does not adequately verify whether a user's assigned role or permission set grants them the right to view specific records within the item master database when interacting via these particular API endpoints.
From an operational perspective, this vulnerability enables unauthorized data exfiltration by attackers who have already obtained valid credentials with limited privileges. An attacker leveraging low-level access can systematically query these unprotected endpoints to retrieve sensitive inventory and product information that should be restricted to higher-privileged roles such as administrators or procurement managers. The impact extends beyond simple privacy violations; exposure of item master data can reveal supply chain vulnerabilities, cost margins, and stock availability to competitors or malicious actors. This intelligence could facilitate further attacks, including targeted phishing campaigns based on known vendor relationships or strategic business decisions derived from leaked inventory levels. The vulnerability aligns with CWE-269, which addresses Improper Privilege Management, as the system fails to restrict functions according to authorized roles and permissions.
The technical root cause lies in the implementation of the endpoint logic within the Frappe framework's request handling layer. When processing requests for item master data, the application likely relies on default or generic permission checks that do not account for specific record-level restrictions required by ERPNext's multi-tenant architecture. Consequently, any authenticated session can trigger these endpoints without triggering a denial response based on role-based access control policies. This oversight highlights a common challenge in web applications where API routes are exposed to the public interface but lack granular authorization middleware that validates user permissions against specific data objects before returning results.
To mitigate this risk, organizations running affected versions of Frappe ERPNext must immediately upgrade to version 15.118.2 or later for the v15 branch, and version 16.30.0 or later for the v16 branch. These updates contain patches that enforce strict authorization checks on item master data endpoints, ensuring that users can only access records permitted by their assigned roles. In addition to upgrading, administrators should review existing user permissions and apply the principle of least privilege to minimize the blast radius if similar vulnerabilities are discovered in other modules. Implementing web application firewalls with behavioral analysis capabilities may also provide an additional layer of detection for abnormal data retrieval patterns associated with this type of information disclosure attack. This incident underscores the importance of rigorous code review processes focused on access control logic, particularly within enterprise software where role-based permissions are complex and frequently updated. The vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, as it exploits legitimate credentials to achieve unauthorized data access without requiring privilege escalation or initial compromise beyond basic authentication.