Threat database

CVE-2026-109655 is a missing authorization vulnerability in Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0. Certain endpoints do not enforce proper role-based authorization checks, allowing authenticated low-privileged users to modify inventory records beyond their permitted roles.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.

CVE-2026-109652 is a server-side template injection vulnerability in Frappe ERPNext. It affects versions before 15.119.1 and 16.x before 16.32.0. The flaw arises because user-controlled message fields are not properly validated before template rendering, allowing authenticated users with common operational roles to inject template expressions. This can lead to unauthorized reading and writing of database data, document deletion, outbound server requests, and sending mail from the site.

CVE-2026-109651 is a server-side request forgery (SSRF) vulnerability in Frappe ERPNext. It affects versions before 15.112.0 and 16.x before 16.23.0. The flaw arises from a configuration field writable by common operational roles that allows arbitrary outbound request destinations without validation. This enables authenticated attackers to make the server send requests to internal network addresses that are otherwise inaccessible externally.

CVE-2026-109650 is a missing authorization vulnerability in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0. This flaw allows authenticated low-privileged users to access personal data beyond their role permissions by exploiting certain endpoints that lack proper authorization checks.

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.

CVE-2026-109647 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.106.0 and 16.x before 16.16.0. The flaw arises from missing input validation in multiple endpoints, allowing authenticated attackers to manipulate database queries and extract sensitive data. The vulnerability has a high severity score of 7.1 and requires authenticated access to exploit.

CVE-2026-109646 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.106.0 and 16.x before 16.16.0. It allows authenticated low-privileged attackers to inject SQL commands via certain endpoints lacking proper input validation, potentially exposing sensitive database information.

CVE-2026-109645 is a missing authorization vulnerability in Frappe ERPNext that affects versions before 15.119.0 and 16.x before 16.31.0. This flaw allows authenticated users to bypass role-based access controls on certain endpoints, enabling them to create and modify records beyond their permissions. The vulnerability has a high severity with a CVSS score of 7.1.

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.

CVE-2026-109642 is a medium severity vulnerability in Frappe ERPNext where certain endpoints do not enforce proper authorization checks. This allows authenticated users to access data beyond their assigned roles. The issue affects versions before 15.110.0 and 16.x before 16.21.0.

CVE-2026-109641 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.110.0 and 16.x before 16.21.0. Certain endpoints do not enforce authorization checks, allowing unauthenticated remote attackers to create records and enumerate availability even if the administrator has disabled the related feature. The vulnerability has a medium severity with a CVSS score of 6.9.

CVE-2026-109640 is a missing authorization vulnerability in Frappe ERPNext versions before 16.22.0. Authenticated users can exploit this flaw to modify records by accessing endpoints that lack proper authorization checks, allowing unauthorized data modification beyond their role permissions. The vulnerability has a high severity rating with a CVSS score of 7.2.

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

CVE-2026-109637 is a missing authorization vulnerability in Frappe ERPNext versions before 16.14.0. It allows authenticated users with limited privileges to modify master data beyond their authorized roles by exploiting endpoints that lack proper authorization checks. This vulnerability has a high severity score of 7.1 and affects versions from initial releases up to but not including 16.14.0.

CVE-2026-109636 is a missing authorization vulnerability in Frappe ERPNext that affects versions before 15.115.0 and 16.x before 16.26.0. Certain endpoints do not enforce proper permission checks, allowing authenticated users with low privileges to access financial data beyond their authorized roles.