CVE-2026-109629

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.3 Frappe ERPNext versions 16.x prior to 16.35.0

Description An issue exists where an endpoint used for sending transactional emails fails to verify the authorization of the caller. This allows any authenticated user to specify arbitrary message content and recipient lists, enabling the delivery of attacker-controlled messages that appear to originate from the organization's configured outgoing email account.

Recommendations Update to version 15.121.3 or later. Update to version 16.35.0 or later.