CVE-2026-109659 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.113.0 and version 16.x prior to 16.24.0. This vulnerability is classified as an Insecure Direct Object Reference or Broken Access Control issue, where the application logic fails to validate whether the authenticated user possesses the necessary privileges to access specific resources. The core technical deficiency lies in the server-side endpoint handlers which do not adequately check the permissions associated with the current session token against the requested data scope. Consequently, any individual who has successfully authenticated into the system can manipulate request parameters or directly invoke internal API endpoints that are intended for higher-privileged roles such as accountants, financial managers, or administrators. This lack of server-side enforcement allows attackers to bypass role-based access controls entirely by simply sending HTTP requests to these unprotected routes, effectively treating them as public resources despite their sensitive nature.
The operational impact of this vulnerability is severe due to the sensitivity of the data involved. Financial data typically includes detailed records of transactions, bank statements, payroll information, vendor payments, and internal cost structures. Unauthorized access to this information can lead to significant financial fraud, competitive intelligence theft, or regulatory non-compliance depending on the industry sector in which the ERPNext instance is deployed. An attacker with low-level privileges could exfiltrate comprehensive financial reports that should be restricted to executive leadership or finance departments. This exposure not only compromises confidentiality but also undermines the integrity of business operations by allowing unauthorized parties to understand cash flow patterns, identify vulnerable payment processes, and potentially plan further attacks such as social engineering or targeted fraud based on the acquired intelligence.
From a standards perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization within the Common Weakness Enumeration taxonomy. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it relies on legitimate credentials, and potentially T1530 Data from Cloud Storage if the financial data is stored in associated cloud buckets accessible via these endpoints. The exploitation does not require complex buffer overflows or injection payloads but rather a straightforward understanding of the application's API structure, making it easily exploitable by automated tools or script-kiddies once discovered.
Mitigation strategies must prioritize immediate patching to the latest stable versions where this authorization logic has been corrected. Administrators should upgrade Frappe ERPNext to version 15.113.0 or later for the v15 branch, and version 16.24.0 or later for the v16 branch. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations include implementing a Web Application Firewall rule set that restricts access to known sensitive API endpoints based on IP reputation or user-agent analysis, although this is less effective than proper code-level fixes. Additionally, organizations should conduct an audit of their current role definitions and permission sets to ensure the principle of least privilege is strictly enforced across all modules. Regular security assessments focusing specifically on broken object level authorization are recommended to detect similar misconfigurations in other parts of the application before they can be exploited by malicious actors seeking financial data or system control.