Missing Authorization Vulnerability in Frappe ERPNext Affecting Inventory Management

CVE-2026-109655

What is CVE-2026-109655?

Frappe ERPNext versions prior to 15.115.0 and 16.x prior to 16.26.0 exhibit a security weakness due to a missing authorization check in specific endpoints. This vulnerability allows authenticated users with low privileges to exploit the system by sending requests that enable them to modify inventory records beyond their authorized role. It is crucial for organizations using ERPNext to apply necessary patches and enhance security measures to prevent unauthorized data manipulation.

References