CVE-2026-109664 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Frappe ERPNext versions prior to 15.112.0 represents a critical failure in access control mechanisms, specifically categorized as an Insecure Direct Object Reference or Broken Access Control issue within the application logic. This flaw stems from insufficient validation on specific API endpoints that handle record modifications. While the system correctly enforces role-based permissions for initial data retrieval and standard operations, it fails to re-validate authorization when processing update requests through these particular interfaces. Consequently, an authenticated user possessing a common operational role can bypass intended restrictions by directly invoking these vulnerable endpoints with modified parameters targeting records assigned to other roles or administrative levels that should be inaccessible to them.
From a technical perspective, the core of this vulnerability lies in the server-side logic handling HTTP POST or PUT requests for record updates. The application likely checks permissions during the initial page load or data listing phase but neglects to perform a secondary authorization check when persisting changes made via direct API calls. This allows an attacker who has valid credentials and a standard user role to manipulate database fields associated with high-privilege records, such as financial transactions, system configurations, or sensitive customer information. The absence of this validation means that the integrity of the data model is compromised, as users can alter attributes they are not authorized to view or modify, effectively elevating their privileges without needing a separate authentication bypass exploit.
The operational impact of this vulnerability is significant for organizations relying on ERPNext for critical business processes. By modifying records beyond their permissions, attackers can tamper with financial data, leading to inaccurate reporting and potential fraud. They may also alter user access controls, potentially locking out administrators or granting themselves higher-level privileges permanently. Furthermore, the ability to change fields outside of one's role undermines audit trails and compliance requirements, as actions are recorded under the attacker’s identity but affect resources they should not control. This can lead to severe data integrity issues, regulatory non-compliance with standards such as GDPR or SOX, and a loss of trust in the system’s security posture among stakeholders and clients who depend on accurate operational data.
To mitigate this risk, organizations running Frappe ERPNext must immediately upgrade to version 15.112.0 or later, where these validation checks have been implemented by the developers. For environments that cannot be upgraded instantly due to compatibility constraints, temporary mitigations include restricting direct access to the affected API endpoints through web application firewalls if possible, and implementing strict server-side logging and monitoring for unusual update patterns originating from standard user accounts. Additionally, reviewing custom scripts or integrations that interact with these specific endpoints is advisable to ensure no third-party code exacerbates the issue until the patch is applied. Regular security audits focusing on role-based access control enforcement across all API interfaces are recommended to prevent similar vulnerabilities in future updates.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, and maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to perform unauthorized actions due to flawed application logic rather than credential theft or brute force attacks. Understanding this classification helps security teams prioritize patching efforts based on the potential for data tampering and privilege escalation inherent in broken access control flaws within enterprise resource planning systems.