PT-2026-111081

CVE-2026-109668

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.110.0 Frappe ERPNext versions 16.x prior to 16.21.0

Description Certain endpoints that handle party records lack proper authorization. This allows authenticated users with low-privileged accounts to send requests to these endpoints and modify data beyond their permitted role, resulting in unauthorized changes to party records.

Recommendations Update to version 15.110.0 or later. Update to version 16.21.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Diptanilsaha

Nssys

Vnth4Nhnt

Vendors

Affected products

Weakness enumeration