CVE-2026-109642: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.110.0 and 16.x prior to 16.21.0 contain a missing authorization vulnerability. Certain endpoints do not enforce adequate authorization controls, enabling authenticated users to query and read data that exceeds their role permissions. This issue could lead to unauthorized data disclosure within the application.

Authenticated users can exploit this vulnerability to access data beyond their assigned roles, potentially leading to unauthorized disclosure of sensitive information within the ERPNext system. There is no indication of privilege escalation or remote unauthenticated exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until then, restrict access to trusted users and review role permissions carefully.