CVE-2026-109660 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Frappe ERPNext versions prior to 15.112.0 and 16.x prior to 16.23.0 represents a critical failure in access control mechanisms within the enterprise resource planning software. This flaw specifically affects endpoints responsible for modifying production records, which are central to manufacturing workflows such as work orders, bill of materials updates, and inventory adjustments. The core technical issue stems from an improper authorization check where the application fails to validate whether the authenticated user possesses the necessary permissions to perform specific write operations on these sensitive data structures. Consequently, the system relies implicitly on client-side controls or assumes that session context alone is sufficient for security decisions, rather than enforcing strict server-side role-based access control checks against a comprehensive permission matrix.
From an operational perspective, this vulnerability allows any authenticated user with low-privileged roles to escalate their effective privileges regarding production data manipulation. An attacker who has gained valid credentials through phishing, credential stuffing, or other means can exploit these endpoints to alter critical manufacturing records without detection by standard audit logs that might only track the action rather than the legitimacy of the actor's intent. This capability undermines the integrity of supply chain management processes, potentially leading to incorrect production schedules, inaccurate inventory levels, and financial discrepancies in cost accounting. The ability to modify production data arbitrarily can also facilitate further attacks, such as injecting malicious code into scripts or altering parameters that affect downstream systems integrated with ERPNext via API calls.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Control, specifically the scenario where a user acts beyond their assigned privileges. It is also relevant to CWE-862, Missing Authorization Check, as the application does not verify if the current session has permission for the requested action before executing it. In terms of threat modeling and adversary behavior, this flaw maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to move laterally or escalate privileges within a networked environment. Furthermore, because ERPNext often serves as a central hub for business operations, compromising production data integrity can be categorized under T1496, Resource Hijacking, if the modifications lead to resource misallocation, or more broadly under supply chain compromise vectors that disrupt organizational continuity and trust in digital systems.
To mitigate this vulnerability, organizations running affected versions of Frappe ERPNext must immediately apply the official patches released in version 15.112.0 and 16.23.0 respectively. These updates address the underlying logic errors by implementing rigorous server-side validation for all production-related API endpoints. In addition to patching, administrators should review their role definitions within the ERPNext interface to ensure that permissions are granted on a least-privilege basis, restricting write access to production modules only to users who strictly require it for their job functions. Implementing multi-factor authentication adds an additional layer of security by reducing the risk of credential compromise, while regular auditing of user activity logs can help detect any anomalous behavior indicative of exploitation attempts before significant damage occurs.