PT-2026-111050 · Frappe · Erpnext
CVE-2026-109637
·
Published
2026-10-12
·
Updated
2026-10-12
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erpnext