CVE-2026-109632: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.121.0 and 16.x prior to 16.33.0 contain a missing authorization vulnerability. Certain API endpoints fail to enforce proper authorization, enabling authenticated users to directly call these endpoints and read data beyond their permitted roles. This issue affects versions >=0 and <15.121.0, as well as >=16.0.0-beta.1 and <16.33.0. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1 (Network attack vector, low complexity, no privileges required beyond authentication, no user interaction, high impact on confidentiality).

Authenticated users can exploit this vulnerability to access data they are not authorized to view, potentially leading to unauthorized disclosure of sensitive information within the ERPNext system. There is no indication of privilege escalation or integrity/availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a software vulnerability affecting specific versions, upgrading to versions 15.121.0 or later and 16.33.0 or later is expected to resolve the issue once official patches are released. Until then, restrict access to authenticated users and monitor for unusual access patterns.