CVE-2026-109660: Missing Authorization in frappe erpnext

This vulnerability in Frappe ERPNext allows authenticated low-privileged users to bypass authorization controls on specific endpoints that modify production records. Versions prior to 15.112.0 and 16.x prior to 16.23.0 are affected. The flaw permits unauthorized modification of production data, violating role-based access controls. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond low privilege, no user interaction, and high impact on integrity.

An attacker with low-level authenticated access can modify production data beyond their assigned permissions, potentially leading to unauthorized data changes in critical business processes. This could disrupt operations or cause data integrity issues within ERPNext environments.

A fix is available in versions 15.112.0 and 16.23.0 and later. Users should upgrade to these versions or later to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.