CVE-2026-109667

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.111.0 Frappe ERPNext versions 16.x prior to 16.22.0

Description An issue exists in a record-creation endpoint that accepts the record type from the request and inserts the record while permission checks are disabled. This allows any authenticated user, regardless of their operational role, to specify a privileged record type to create privileged accounts and gain full control of the site.

Recommendations Update to version 15.111.0 or later. Update to version 16.22.0 or later.