CVE-2026-109665 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.108.0 and version 16.x prior to 16.18.0. This vulnerability is classified as a Broken Access Control issue, which corresponds directly to CWE-269 in the Common Weakness Enumeration taxonomy. The core technical deficiency lies in the implementation of authorization logic for specific API endpoints within the application's backend architecture. These particular endpoints are designed to handle administrative or master data management tasks but fail to perform adequate verification of the requesting user's permissions before executing state-changing operations. Consequently, the system relies on implicit trust regarding the caller's identity rather than enforcing explicit role-based access control policies at the point of execution.
This architectural oversight allows authenticated users with low-privileged roles to bypass intended security restrictions. In a properly secured environment, actions such as deactivating master records should be restricted to administrators or users with specific high-level privileges due to the critical nature of maintaining data integrity and system stability. However, because the authorization checks are missing for these endpoints, an attacker who has obtained valid credentials for a standard user account can interact directly with these API interfaces. The attack vector typically involves crafting HTTP requests that target the vulnerable endpoints, effectively exploiting the lack of server-side validation to perform actions that should be prohibited by their assigned role.
The operational impact of this vulnerability is significant and potentially disruptive to business operations. Master records in ERP systems often serve as foundational data structures for various modules, including inventory, accounting, human resources, and sales. Deactivating these records can lead to cascading failures across dependent processes. For instance, deactivating a customer master record might prevent the creation of new invoices or disrupt existing order fulfillment workflows. Similarly, disabling item masters could halt production planning or procurement activities. Beyond immediate functional disruption, this unauthorized modification compromises the integrity of critical business data and undermines the principle of least privilege that is central to secure system design.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials for malicious purposes, specifically within the context of lateral movement or privilege escalation through functional abuse rather than traditional credential theft. The ability to modify master data without authorization also touches upon aspects of configuration handling and system integrity violations. Attackers can exploit this flaw to cause denial of service conditions by systematically disabling essential records, thereby forcing organizations into costly recovery procedures involving database restoration from backups or manual re-entry of critical information.
To mitigate this vulnerability, administrators must upgrade the Frappe ERPNext instance immediately to version 15.108.0 or later for the v15 branch, and to version 16.18.0 or later for the v16 branch. These releases contain the necessary patches that enforce proper permission checks on the affected endpoints. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should be implemented at the network perimeter level. This can include configuring web application firewalls to block direct access to these specific API paths from untrusted networks or restricting access to administrative interfaces through IP whitelisting and multi-factor authentication requirements. Additionally, organizations should conduct a thorough review of their user role assignments to ensure that no low-privileged users have unnecessary permissions that could be leveraged in conjunction with other potential weaknesses. Regular security audits and penetration testing focused on authorization bypasses are recommended to identify similar gaps in access control logic across the application surface area.