CVE-2026-109644: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.119.0 and 16.x prior to 16.31.0 contain a missing authorization vulnerability in specific API endpoints that handle valuation data. These endpoints fail to enforce adequate authorization controls, enabling authenticated users with low privileges to query and retrieve valuation information that should be restricted. The vulnerability is identified as CVE-2026-109644 with a CVSS 4.0 score of 7.1, indicating a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

An attacker with valid low-privileged credentials can exploit this vulnerability to read sensitive valuation data beyond their permitted access level. This unauthorized data disclosure can lead to information leakage, potentially affecting business confidentiality and decision-making processes. There is no indication of privilege escalation or integrity/availability impact.

A fix is available in Frappe ERPNext versions 15.119.0 and 16.31.0 and later. Users should upgrade to these versions or later to remediate this missing authorization vulnerability. Since this is not a cloud service, manual patching by upgrading the affected software versions is required. Patch status is confirmed by the version boundaries provided.