CVE-2026-109669 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in the implementation of Role-Based Access Control within Frappe ERPNext versions prior to 15.110.0 and 16.x prior to 16.21.0. This vulnerability is classified as an Insecure Direct Object Reference or Broken Access Control issue, specifically falling under CWE-862: Missing Authorization. The core technical defect lies in the application logic governing record status modifications. While the system correctly enforces permissions for initial data creation and viewing based on user roles, it fails to validate whether the authenticated user possesses the necessary privileges before allowing changes to specific fields that alter the state of a business object. This oversight allows any authenticated account with low-level privileges to interact directly with API endpoints responsible for updating record statuses without triggering the expected permission checks.
From an operational perspective, this vulnerability enables unauthorized data manipulation by attackers who have obtained valid credentials through phishing, credential stuffing, or other means. An attacker leveraging this flaw can escalate their effective permissions within the application context. By modifying record status fields that are typically restricted to administrators or managers, such as marking invoices as paid, changing order statuses from pending to completed, or altering inventory levels, the attacker can disrupt business operations and compromise data integrity. This bypass of intended role-based access restrictions undermines the fundamental security model of the ERP system, potentially leading to financial discrepancies, supply chain disruptions, and loss of trust in the platform's reliability.
The impact extends beyond simple data corruption. In enterprise resource planning systems, status changes often trigger downstream processes such as payment processing, shipping logistics, or inventory reconciliation. An unauthorized change can cause these automated workflows to execute incorrectly, resulting in significant financial losses or operational bottlenecks. Furthermore, because the vulnerability relies on missing authorization checks rather than a complex exploitation technique like buffer overflow or SQL injection, it is relatively easy to exploit using standard web tools or simple script automation. This low barrier to entry increases the likelihood of successful attacks against systems that have not yet applied the necessary patches.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.110.0 or later for the v15 branch, and version 16.21.0 or later for the v16 branch. These updates contain the corrected authorization logic that properly validates user permissions before processing status change requests. In addition to patching, administrators should review their access control policies to ensure they adhere to the principle of least privilege. Implementing additional monitoring and logging mechanisms can help detect anomalous activity patterns indicative of exploitation attempts. Security teams should also consider deploying Web Application Firewalls configured with rules that monitor for unusual sequences of API calls related to status modifications, providing an extra layer of defense while patch management is underway. This vulnerability aligns with the MITRE ATT&CK technique T1078: Valid Accounts, as it requires initial authentication but allows subsequent privilege escalation through broken access control mechanisms.