CVE-2026-109658: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.115.0 and 16.x prior to 16.26.0 contain a missing authorization vulnerability. Certain API endpoints do not enforce adequate authorization checks, enabling authenticated users to read data that should be restricted based on their assigned roles. This can lead to unauthorized disclosure of sensitive and personal information. The vulnerability has a CVSS 4.0 score of 7.1, indicating a high severity level. There is no indication of known exploits in the wild or vendor-provided patch information in the provided data.

Authenticated users can exploit this vulnerability to access data beyond their authorized permissions, including personal data. This unauthorized data access could lead to privacy violations and potential misuse of sensitive information. The vulnerability does not require user interaction and has a network attack vector, increasing the risk of exploitation within an authenticated environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ERPNext endpoints to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary privileges to users to minimize potential impact.