CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109672

Frappe ERPNext is vulnerable to a missing authorization vulnerability in certain endpoints prior to versions 15.118.0 and 16.27.0 . This flaw allows authenticated users to bypass role-based access controls and query endpoints to access sensitive financial data beyond their permitted privileges. N...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109661 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

CVE-2026-109661

Frappe ERPNext versions before 15.116.0 and 16.x before 16.27.0 are vulnerable to a missing authorization flaw (CWE-862) in certain endpoints. The root cause is a failure to enforce proper authorization checks, which allows authenticated attackers with low-privileged accounts to query these endpo...

CVE-2026-109661 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

CVE-2026-109659 Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109659

Frappe ERPNext versions before 15.113.0 and 16.x before 16.24.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks, allowing authenticated users to access and read financial data exceeding the permissions of their assigned roles. N...

CVE-2026-109659 Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted rol...

CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted rol...

CVE-2026-109636

Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0 are susceptible to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce adequate permission checks, allowing authenticated attackers with low-privileged accounts to access and read financial data exceedi...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109627

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 are affected by a missing authorization vulnerability (CWE-862). The flaw allows authenticated low-privileged users to access specific endpoints that fail to enforce proper permission checks. Exploiting this allows users to read fina...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109625

Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce role-based authorization checks , allowing authenticated users to access and read financial data exceeding their assigned permissions. No spe...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109614

Frappe ERPNext versions prior to 16.34.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass intended role restrictions and query endpoints that lack proper access controls. Consequently, attackers can access sensitive financial recor...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...