CVE-2026-109636: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.115.0 and 16.x prior to 16.26.0 contain a missing authorization vulnerability. This occurs because some API endpoints fail to enforce adequate permission checks, enabling authenticated attackers with low-privileged accounts to read sensitive financial data that should be restricted based on their roles. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a high severity level. There is no indication of known exploits in the wild or vendor-provided patches in the provided data.

Authenticated users with low privileges can exploit this vulnerability to access financial data beyond their permitted roles, potentially leading to unauthorized disclosure of sensitive financial information. This could impact confidentiality but does not indicate privilege escalation or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected ERPNext versions and monitor for unusual access patterns. Avoid granting unnecessary privileges to users and consider additional access controls on financial data endpoints.