CVE-2026-109643: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.111.0 and 16.x prior to 16.22.0 contain a missing authorization vulnerability in specific project-related API endpoints. These endpoints fail to enforce permission checks, enabling authenticated users with low privileges to directly call these endpoints and read project data that should be restricted based on their assigned roles. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality.

An authenticated user with low privileges can bypass authorization controls on certain project-related endpoints, leading to unauthorized disclosure of sensitive project data beyond their permitted access. This could result in exposure of confidential information within the ERP system.

Upgrade Frappe ERPNext to version 15.111.0 or later, or 16.22.0 or later, where this missing authorization vulnerability has been fixed. No other mitigation or temporary workaround is indicated in the available data.