CVE-2026-109615: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.121.0 and 16.x prior to 16.34.0 contain a missing authorization vulnerability in specific API endpoints. These endpoints fail to enforce proper permission checks during document creation, enabling authenticated users with low privileges to create documents associated with records outside their authorized roles. This vulnerability effectively bypasses role-based access controls, potentially allowing unauthorized data manipulation within the ERP system.

The vulnerability allows authenticated users with limited privileges to create documents beyond their authorized scope, bypassing role-based access controls. This can lead to unauthorized data creation and potential integrity issues within the ERP system. There is no indication of remote code execution or data disclosure, but the unauthorized creation of records can disrupt business processes and data trustworthiness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints to trusted users only and monitor for unusual document creation activities. Avoid granting unnecessary privileges to low-privileged users to reduce risk.