PT-2026-111058

CVE-2026-109645

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0

Description Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers to bypass role-based access restrictions. This allows the creation of records and modification of data beyond the permissions assigned to the attacker's role.

Recommendations Update to version 15.119.0 or later. Update to version 16.31.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Diptanilsaha

Snoopysecurity

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization