CVE-2026-109635: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.105.0 and 16.x prior to 16.15.0 contain a missing authorization vulnerability in specific document creation endpoints. These endpoints fail to verify that the authenticated portal user making the request is associated with the target party, enabling unauthorized document creation on behalf of other parties. This issue could lead to unauthorized data manipulation within the ERP system by authenticated portal users.

Authenticated portal users can exploit this vulnerability to create documents impersonating other parties, potentially leading to unauthorized data creation and manipulation within the ERP system. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low attack complexity, no user interaction required, and limited impact on confidentiality and integrity.

The vulnerability affects versions before 15.105.0 and 16.x before 16.15.0. Users should upgrade to version 15.105.0 or later, or 16.15.0 or later, where this authorization check has been implemented. Patch status is not explicitly confirmed in the provided data, but the affected version ranges imply fixes in these versions. Check the vendor advisory for official patch availability and remediation guidance.