Privilege Escalation Vulnerability in Frappe ERPNext by Frappe

CVE-2026-109667

What is CVE-2026-109667?

Frappe ERPNext versions prior to 15.111.0 and 16.22.0 are susceptible to a privilege escalation issue, which allows authenticated users to create privileged records without proper permission checks. This vulnerability arises in a specific record-creation endpoint where users can insert a record type from their requests. By exploiting this flaw, users lacking operational roles can craft requests that provide access to privileged account capabilities, potentially compromising the entire site’s security.

References