Threat database

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.

CVE-2026-109622 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. This flaw allows authenticated users to bypass proper authorization checks on certain endpoints, enabling them to modify data beyond their assigned roles. The vulnerability impacts data integrity but does not require user interaction and has a medium severity rating.

CVE-2026-109621 is an authorization bypass vulnerability in Frappe ERPNext versions before 15.120.0 and 16.x before 16.23.0. The flaw exists in an endpoint that accepts a caller-supplied flag which disables its own permission enforcement. Authenticated attackers can exploit this to skip permission checks and access party records beyond their authorized roles.

CVE-2026-109617 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. It allows authenticated low-privileged users to create documents beyond their permitted roles by bypassing role-based permission checks on certain endpoints.

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.

CVE-2026-109614 is a missing authorization vulnerability in Frappe ERPNext versions before 16.34.0. Authenticated users can exploit this flaw to access financial data beyond their permitted roles by querying endpoints that lack proper authorization checks. This vulnerability allows unauthorized disclosure of sensitive financial records.

CVE-2026-109613 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0. It allows authenticated low-privileged users to modify document status via certain endpoints without proper authorization checks, bypassing role-based access controls.

CVE-2026-109612 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext affecting versions before 15.120.0 and 16.x before 16.33.0. The flaw occurs in a report view that inserts stored record names into web page markup without proper escaping. Authenticated users who can create records may exploit this by embedding malicious scripts in record names, which execute in the browsers of users viewing the report.

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

CVE-2026-109609 is an SQL injection vulnerability in Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0. Authenticated users with low privileges can exploit insufficient input validation in certain endpoints to inject SQL commands and extract sensitive database information. The vulnerability has a high severity with a CVSS score of 7.1.

CVE-2026-109608 is a high-severity SQL injection vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. It allows any authenticated user, even those without assigned roles, to send specially crafted requests to certain endpoints lacking input validation. Exploitation can lead to unauthorized reading of sensitive user information and privilege escalation to a higher-level account.

CVE-2026-109604 is a stored cross-site scripting (XSS) vulnerability in Frappe ERPNext. It affects versions before 15.112.0 and 16.x before 16.23.0. The flaw arises because a tool view interpolates stored record names into web page markup without proper escaping. An authenticated user who can create records with malicious names can execute scripts in the sessions of users who later view those records. This vulnerability has a high severity score of 8.5.

CVE-2025-71432 is a reflected cross-site scripting (XSS) vulnerability in Frappe ERPNext. It affects versions before 14.92.1 and 15.x before 15.83.0. The vulnerability arises from improper input validation on a certain page, allowing attackers to inject arbitrary JavaScript. Exploitation requires a logged-in user to open a crafted URL, potentially leading to account takeover.

ERPNext versions 9.0.0 through 16.50.0 have a missing authorization vulnerability that allows authenticated users, including customer portal users, to access stock quantity information via certain whitelisted batch methods. This exposure enables attackers to list item batches with per-warehouse quantities without proper permission checks.

ERPNext versions 15.55.0 through 16.50.0 have an authorization vulnerability in the get_timesheet_html method. Authenticated portal users can access project timesheets without proper authorization checks, bypassing hide_timesheets settings and project membership requirements. This leads to unauthorized viewing of timesheet details including names, status, time-log dates, and last modifiers.

Frappe CRM versions 1.49.0 through 1.87.0 have a missing authorization vulnerability in the crm.api.doc.get_linked_docs_of_document function. This flaw allows authenticated users to access linked documents without proper permission checks, potentially exposing sensitive information such as call log phone numbers, deal organizations, and mention notification text. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Frappe HR (hrms) versions before 16.11.0, including all 14.x and 15.x releases up to 15.64.3, have a missing authorization vulnerability in the expire_allocation method. This flaw allows authenticated users without HR roles to expire any employee's leave allocation by sending a specially crafted POST request, effectively zeroing out the targeted employee's remaining leave balance.

Frappe HR (hrms) versions before 16.11.0, including all 14.x and 15.x releases through 15.64.3, have a missing authorization vulnerability in the whitelisted get_account_and_amount method. This flaw allows authenticated users without HR roles to access payroll information of other employees by calling the method via the /api/method endpoint with enumerable Salary Slip or claim document names. The disclosed data includes net pay and balances for loans, advances, and claims. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity.