CVE-2026-109668 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.110.0 and version 16.x prior to 16.21.0. This vulnerability is classified as an insecure direct object reference or broken access control issue, where the application fails to properly verify that a user has sufficient privileges to perform actions on specific data objects. In enterprise resource planning systems like ERPNext, party records typically contain sensitive information regarding customers, vendors, and other business partners, including financial details, contact information, and contractual terms. The absence of robust authorization checks allows authenticated users with low-privileged roles to bypass intended restrictions and modify these records in ways that should be reserved for administrators or higher-level personnel.
From a technical perspective, the vulnerability stems from insufficient validation at the endpoint level when handling party-related data operations. When an authenticated user submits a request to update or delete party information, the backend logic does not adequately cross-reference the user's assigned role against the permissions required for that specific action. This oversight enables attackers who have obtained valid credentials with limited access rights to exploit these endpoints directly. By crafting HTTP requests targeting these vulnerable interfaces, malicious actors can alter critical business data without triggering appropriate security alerts or requiring elevated privileges. The flaw highlights a common architectural weakness where session-based authentication is present but role-based authorization checks are either missing or incorrectly implemented for certain API routes and web forms.
The operational impact of this vulnerability extends beyond simple unauthorized modifications to party records. In an ERP environment, such data integrity breaches can lead to significant financial discrepancies, incorrect invoicing, supply chain disruptions, and compliance violations. For instance, a low-privileged user could alter vendor bank account details to redirect payments or modify customer credit limits to facilitate fraudulent transactions. Furthermore, the ability to tamper with party records undermines the audit trail reliability, making it difficult for organizations to maintain accurate logs of who accessed or changed sensitive information. This erosion of trust in data integrity can have severe consequences for regulatory compliance and overall business continuity.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as well as CWE-862, Missing Authorization, indicating that the system does not enforce proper access controls on resources based on user roles. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to move laterally or escalate privileges by exploiting misconfigured permissions rather than breaking into the system through traditional exploitation methods. The attack vector is classified as remote with low complexity and requires authentication, placing it at a high severity level due to its potential for widespread data manipulation within enterprise environments.
To mitigate this risk, organizations running affected versions of Frappe ERPNext must immediately upgrade to version 15.110.0 or later, which includes the necessary patches to enforce strict authorization checks on party record endpoints. Until an upgrade is feasible, administrators should implement compensating controls such as network-level access restrictions to limit exposure of these specific endpoints and conduct thorough audits of user roles and permissions within the system. It is also advisable to enable detailed logging for all data modification events related to parties to detect any anomalous activity indicative of exploitation attempts. Regular security assessments and penetration testing focused on role-based access control will help identify similar gaps in other parts of the application before they can be exploited by malicious actors seeking to compromise organizational integrity.