CVE-2026-109661: Missing Authorization in frappe erpnext

Frappe ERPNext versions prior to 15.116.0 and 16.x prior to 16.27.0 contain a missing authorization vulnerability in specific API endpoints. These endpoints fail to enforce adequate authorization controls, enabling authenticated attackers with low-privileged accounts to read financial data that should be restricted. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality.

An attacker with a low-privileged authenticated account can exploit this vulnerability to access sensitive financial data beyond their permitted role. This unauthorized data exposure can lead to confidentiality breaches of financial information within the affected ERPNext deployments.

Patch to ERPNext version 15.116.0 or later, or 16.27.0 or later, where the authorization checks have been properly enforced. Since this is a self-hosted product, administrators should upgrade affected instances promptly to these fixed versions to remediate the vulnerability. Patch status is confirmed by the version information indicating fixed versions.