Stored Cross-Site Scripting Vulnerability in Frappe ERPNext
CVE-2026-109671

8.5HIGH

Key Information:

Vendor: Frappe
Status: Erpnext
Vendor: CVE Published:; 12 October 2026

What is CVE-2026-109671?

Frappe ERPNext versions prior to 15.113.0 and 16.x before 16.24.0 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue permits low-privilege attackers to embed malicious scripts within a profile field, which, when viewed by an administrator, execute in their browser environment. Such a scenario may facilitate unauthorized actions, including the potential takeover of administrator accounts, compromising the overall security of affected systems.

Affected Version(s)

erpnext 0 < 15.113.0

erpnext 16.0.0-beta.1 < 16.24.0

erpnext 15.113.0

References

https://github.com/frappe/erpnext/security/advisories/GHS...

vendor-advisory

https://www.vulncheck.com/advisories/frappe-erpnext-befor...

third-party-advisory

CVSS V4

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 12, 2026
Vulnerability Reserved
Oct 12, 2026

Credit

diptanilsaha

CVE-2026-109671 Data

JSON