CVE-2026-109643 in ERPNext
Сводка
по MITRE • 13.10.2026
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.