Missing Authorization Vulnerability in Frappe ERPNext Product by Frappe

CVE-2026-109664

What is CVE-2026-109664?

Frappe ERPNext prior to version 15.112.0 is susceptible to a missing authorization vulnerability that allows authenticated users to manipulate records beyond their designated permissions. This weakness arises from inadequate validation mechanisms in specific endpoints. Users with common operational roles could exploit this flaw to alter fields on record types they typically do not have the authority to change, resulting in unauthorized data tampering and potential compromise of system integrity.

References