PT-2026-111034

CVE-2026-109621

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.120.0 Frappe ERPNext versions 16.x prior to 16.23.0

Description An authorization bypass exists where an endpoint honors a caller-supplied flag that disables permission enforcement. Authenticated attackers can use this flag to skip permission checks and read party records that exceed their assigned role permissions.

Recommendations Update to version 15.120.0 or later. Update to version 16.23.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Prakhar0X01

Shllokkk

Vnth4Nhnt

Vendors

Affected products

Weakness enumeration