CVE-2026-109672 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw represents a critical failure in access control mechanisms within the Frappe ERPNext framework, specifically affecting versions prior to 15.118.0 and version 16.x prior to 16.27.0. This vulnerability is classified as an Insecure Direct Object Reference or Broken Access Control issue, where the application logic fails to validate whether the authenticated user possesses the necessary permissions to access specific resources. The core technical deficiency lies in the server-side handling of certain API endpoints and data retrieval functions that do not adequately check the role-based access control policies before returning sensitive information. Consequently, an attacker who has successfully obtained valid credentials for a low-privilege account can manipulate request parameters or directly query internal APIs to bypass intended restrictions. This allows the extraction of financial records, such as invoices, payment entries, and ledger details, which are strictly segregated by organizational roles in a properly secured environment.
From an operational perspective, this vulnerability poses a severe risk to data confidentiality and regulatory compliance for organizations relying on ERPNext for their enterprise resource planning needs. Financial data is often subject to strict internal controls and external regulations such as Sarbanes-Oxley or GDPR. The ability of any authenticated user to read financial data beyond their assigned role undermines the principle of least privilege, which is fundamental to secure system design. This flaw could be exploited by malicious insiders seeking to steal competitive intelligence or commit fraud, as well as by external attackers who have compromised a low-level account through phishing or credential stuffing attacks. The impact extends beyond simple data leakage; it compromises the integrity of financial reporting and can lead to significant reputational damage and legal liabilities for affected enterprises.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, indicating that the software does not perform an authorization check before allowing access to a protected resource. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to move laterally or exfiltrate data without triggering typical intrusion detection alerts associated with unauthorized login attempts. The lack of granular permission checks on specific endpoints creates a blind spot that automated vulnerability scanners might miss if they do not simulate role-based access scenarios thoroughly.
To mitigate this risk, organizations must immediately upgrade their ERPNext instances to version 15.118.0 or later for the v15 branch, and version 16.27.0 or later for the v16 branch, as these releases contain patches that enforce proper authorization checks on the affected endpoints. In addition to patching, administrators should conduct a comprehensive audit of user roles and permissions within their ERPNext instance to ensure that no excessive privileges are granted unnecessarily. Implementing strict role-based access control policies and regularly reviewing user activity logs can help detect any anomalous data retrieval patterns indicative of exploitation attempts. Furthermore, deploying Web Application Firewalls with rules designed to detect abnormal API usage by low-privilege users may provide an additional layer of defense against this type of broken access control vulnerability while the upgrade process is being completed.