Threat database

CVE-2026-109635 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.105.0 and 16.x before 16.15.0. It allows authenticated portal users to create documents on behalf of other parties by exploiting certain document creation endpoints that do not verify user-party association.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.

CVE-2026-109632 is a missing authorization vulnerability in Frappe ERPNext. Versions before 15.121.0 and 16.x before 16.33.0 have endpoints that do not enforce proper authorization checks. Authenticated users can access data beyond their assigned roles. The vulnerability has a high severity with a CVSS score of 7.1.

CVE-2026-109631 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.119.1 and 16.x before 16.32.0. It allows authenticated users with low privileges to send crafted requests to certain endpoints lacking proper input validation, potentially extracting sensitive database information. The vulnerability has a high severity score of 7.1.

CVE-2026-109630 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. Authenticated attackers can exploit certain endpoints that do not enforce proper permission checks to access data beyond their assigned roles. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

CVE-2026-109627 is a missing authorization vulnerability in Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0. It allows authenticated low-privileged users to access certain endpoints without proper permission checks, potentially exposing financial data beyond their assigned roles.

CVE-2026-109626 is an SQL injection vulnerability in Frappe ERPNext versions before 16.34.2. It arises from missing input validation in multiple endpoints, allowing authenticated low-privilege attackers to inject SQL commands and extract sensitive database information.

CVE-2026-109625 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0. Certain endpoints do not enforce role-based authorization checks, allowing authenticated users to access financial data beyond their assigned permissions. This vulnerability has a CVSS score of 7.1, indicating high severity.

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.

CVE-2026-109622 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. This flaw allows authenticated users to bypass proper authorization checks on certain endpoints, enabling them to modify data beyond their assigned roles. The vulnerability impacts data integrity but does not require user interaction and has a medium severity rating.

CVE-2026-109621 is an authorization bypass vulnerability in Frappe ERPNext versions before 15.120.0 and 16.x before 16.23.0. The flaw exists in an endpoint that accepts a caller-supplied flag which disables its own permission enforcement. Authenticated attackers can exploit this to skip permission checks and access party records beyond their authorized roles.

CVE-2026-109617 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. It allows authenticated low-privileged users to create documents beyond their permitted roles by bypassing role-based permission checks on certain endpoints.

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.

CVE-2026-109614 is a missing authorization vulnerability in Frappe ERPNext versions before 16.34.0. Authenticated users can exploit this flaw to access financial data beyond their permitted roles by querying endpoints that lack proper authorization checks. This vulnerability allows unauthorized disclosure of sensitive financial records.

CVE-2026-109613 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. It allows authenticated low-privileged users to modify document status via certain endpoints without proper authorization checks, bypassing role-based access controls.