Missing Authorization Vulnerability in Frappe ERPNext by Frappe

CVE-2026-109658

What is CVE-2026-109658?

Frappe ERPNext versions prior to 15.115.0 and 16.x before 16.26.0 are susceptible to a missing authorization vulnerability. This flaw allows authenticated users to interact with specific endpoints that lack proper authorization checks, potentially enabling them to access sensitive information, including personal data, beyond their role's permissions. Organizations using these versions should implement updates promptly to mitigate the risk of unauthorized data exposure.

References