Authorization Bypass in Frappe ERPNext Affects User Data Integrity

CVE-2026-109669

What is CVE-2026-109669?

Frappe ERPNext versions prior to 15.110.0 and 16.x prior to 16.21.0 are susceptible to a missing authorization flaw. This vulnerability occurs due to inadequate enforcement of authorization checks on specific endpoints. As a result, low-privileged authenticated users can exploit these endpoints to modify record status, effectively circumventing the role-based access controls originally intended to safeguard data integrity. This allows unauthorized access and manipulation of sensitive information, posing significant security risks to affected organizations.

References