CVE-2026-109654: Missing Authorization in frappe erpnext
Description
CVE-2026-109654 is a missing authorization vulnerability in Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0. The flaw allows authenticated attackers to trigger transactional emails for documents they are not authorized to read because certain endpoints do not verify read permissions before sending emails.
CVSS v4.0
Score 5.3medium
Affected software
frappe
erpnext
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Frappe ERPNext versions prior to 15.119.0 and 16.x prior to 16.31.0 contain a missing authorization vulnerability. Specifically, some endpoints fail to verify whether the caller has permission to read a document before sending transactional emails related to that document. This allows authenticated users to invoke these endpoints and cause transactional emails to be sent about documents they do not have access to, potentially exposing sensitive information via email notifications.
Potential Impact
Authenticated attackers can trigger transactional emails for documents they are not authorized to read, potentially leading to unauthorized disclosure of information through email notifications. The vulnerability does not allow direct reading of documents but abuses the email functionality to leak information.
Mitigation Recommendations
A fix is available in versions 15.119.0 and 16.31.0 or later. Users should upgrade to these versions to remediate the missing authorization vulnerability. Patch status is confirmed by the version ranges provided. No additional mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T21:06:47.173Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd63e72cdf04f656e1e581
Added to database: 10/12/2026, 22:49:11 UTC
Last enriched: 10/12/2026, 23:19:12 UTC
Last updated: 10/13/2026, 00:08:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.