CVE-2026-109661 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.116.0 and version 16.x prior to 16.27.0. This vulnerability is classified as a broken access control issue where certain API endpoints fail to enforce proper authorization checks before processing requests. In a secure system architecture, every request must be validated against the user's assigned roles and permissions to ensure that data access aligns with organizational policies. However, in these affected versions, specific endpoints lack this critical validation layer, allowing authenticated users to bypass intended restrictions. This represents a significant deviation from standard security practices where role-based access control is strictly enforced at every interaction point within the application logic.
The operational impact of this vulnerability is severe due to the sensitive nature of the data involved. Financial information, including transaction records, account balances, and potentially payroll details, becomes accessible to users who do not hold elevated privileges. An attacker with a low-privileged account can exploit these misconfigured endpoints to query financial data that should be restricted to higher-level roles such as administrators or finance managers. This capability effectively allows an insider threat or an external actor who has compromised a standard user credential to exfiltrate confidential business intelligence. The exposure of such sensitive information violates core principles of confidentiality and integrity, potentially leading to regulatory non-compliance with standards like GDPR or SOX depending on the jurisdiction and industry sector.
From a technical perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, specifically illustrating a failure in enforcing access control restrictions for specific resources. The root cause lies in the application's middleware or controller logic where authorization checks are either omitted or incorrectly implemented for certain routes. This oversight creates an inconsistency in security enforcement across different parts of the system. Attackers can leverage this by crafting HTTP requests to these unprotected endpoints, bypassing the normal UI-based permission filters that typically restrict data visibility. The ease of exploitation is high because it requires only valid authentication credentials and basic knowledge of API structures, making it accessible even to attackers with limited technical expertise.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.116.0 or later for the v15 branch, or version 16.27.0 and later for the v16 branch. These releases contain patches that rectify the authorization logic in the vulnerable endpoints. In addition to upgrading, administrators should conduct a thorough audit of user permissions within their ERPNext instance to ensure that role definitions are granular enough to minimize potential damage from future vulnerabilities. Implementing Web Application Firewalls with strict rule sets can also provide an additional layer of defense by monitoring for anomalous API access patterns indicative of enumeration or data exfiltration attempts. Regular security assessments and penetration testing should be integrated into the development lifecycle to identify similar authorization gaps before they are deployed to production environments, ensuring adherence to ATT&CK techniques related to unauthorized access such as T1078 Valid Accounts and T1530 Data from Cloud Storage if applicable.