CVE-2026-109651

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.112.0 Frappe ERPNext versions 16.x prior to 16.23.0

Description An issue exists where a configuration field, accessible to common operational roles, allows the input of arbitrary outbound request destinations without proper validation. This enables authenticated attackers to force the server to send requests to internal network addresses that are otherwise unreachable from the outside. This is a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location.

Recommendations Update to version 15.112.0 or later. Update to version 16.23.0 or later.