CVE-2026-109611: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.121.0 and 16.x prior to 16.34.0 contain a missing authorization vulnerability in specific endpoints. These endpoints fail to properly enforce authorization checks, which allows authenticated users to perform unauthorized data modifications beyond their role permissions. The vulnerability is identified as CVE-2026-109611 with a CVSS 4.0 base score of 5.3, indicating a medium severity level. No known exploits in the wild have been reported. The affected versions are all versions from initial releases up to but not including 15.121.0, and versions from 16.0.0-beta.1 up to but not including 16.34.0.

Authenticated users can exploit this vulnerability to modify data beyond their assigned roles, potentially leading to unauthorized data changes within the ERP system. This could affect data integrity and business processes relying on ERPNext. There is no indication of privilege escalation beyond authenticated user roles or remote code execution. No known active exploitation has been reported.

A fix is available in versions 15.121.0 and 16.34.0 and later. Users should upgrade to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the affected software installations is required. No vendor advisory content was provided, so check the official ERPNext or Frappe project advisories for the latest remediation guidance.