Threat database

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.

CVE-2026-109642 is a medium severity vulnerability in Frappe ERPNext where certain endpoints do not enforce proper authorization checks. This allows authenticated users to access data beyond their assigned roles. The issue affects versions before 15.110.0 and 16.x before 16.21.0.

CVE-2026-109641 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.110.0 and 16.x before 16.21.0. Certain endpoints do not enforce authorization checks, allowing unauthenticated remote attackers to create records and enumerate availability even if the administrator has disabled the related feature. The vulnerability has a medium severity with a CVSS score of 6.9.

CVE-2026-109640 is a missing authorization vulnerability in Frappe ERPNext versions before 16.22.0. Authenticated users can exploit this flaw to modify records by accessing endpoints that lack proper authorization checks, allowing unauthorized data modification beyond their role permissions. The vulnerability has a high severity rating with a CVSS score of 7.2.

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

CVE-2026-109637 is a missing authorization vulnerability in Frappe ERPNext versions before 16.14.0. It allows authenticated users with limited privileges to modify master data beyond their authorized roles by exploiting endpoints that lack proper authorization checks. This vulnerability has a high severity score of 7.1 and affects versions from initial releases up to but not including 16.14.0.

CVE-2026-109636 is a missing authorization vulnerability in Frappe ERPNext that affects versions before 15.115.0 and 16.x before 16.26.0. Certain endpoints do not enforce proper permission checks, allowing authenticated users with low privileges to access financial data beyond their authorized roles.

CVE-2026-109635 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.105.0 and 16.x before 16.15.0. It allows authenticated portal users to create documents on behalf of other parties by exploiting certain document creation endpoints that do not verify user-party association.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.

CVE-2026-109632 is a missing authorization vulnerability in Frappe ERPNext. Versions before 15.121.0 and 16.x before 16.33.0 have endpoints that do not enforce proper authorization checks. Authenticated users can access data beyond their assigned roles. The vulnerability has a high severity with a CVSS score of 7.1.

CVE-2026-109631 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.119.1 and 16.x before 16.32.0. It allows authenticated users with low privileges to send crafted requests to certain endpoints lacking proper input validation, potentially extracting sensitive database information. The vulnerability has a high severity score of 7.1.

CVE-2026-109630 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. Authenticated attackers can exploit certain endpoints that do not enforce proper permission checks to access data beyond their assigned roles. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

CVE-2026-109627 is a missing authorization vulnerability in Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0. It allows authenticated low-privileged users to access certain endpoints without proper permission checks, potentially exposing financial data beyond their assigned roles.

CVE-2026-109626 is an SQL injection vulnerability in Frappe ERPNext versions before 16.34.2. It arises from missing input validation in multiple endpoints, allowing authenticated low-privilege attackers to inject SQL commands and extract sensitive database information.

CVE-2026-109625 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0. Certain endpoints do not enforce role-based authorization checks, allowing authenticated users to access financial data beyond their assigned permissions. This vulnerability has a CVSS score of 7.1, indicating high severity.

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.