CVE-2026-109617: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.121.0 and 16.x prior to 16.34.0 contain a missing authorization vulnerability in certain API endpoints responsible for document creation. These endpoints fail to enforce adequate authorization checks, enabling authenticated users with low privileges to create documents associated with records outside their permitted roles. This flaw effectively bypasses role-based permission restrictions, potentially allowing unauthorized data creation within the system.

The vulnerability allows authenticated users with limited privileges to bypass role-based access controls and create documents beyond their authorized scope. This can lead to unauthorized data creation and potential data integrity issues within the ERP system. There is no indication of remote code execution or data disclosure, but unauthorized document creation can disrupt business processes and data trustworthiness.

A fix is available in Frappe ERPNext versions 15.121.0 and 16.34.0 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Since this is not a cloud service, manual patching is required. No vendor advisory content was provided, so check the official Frappe ERPNext release notes or security advisories for detailed patch instructions.