CVE-2026-109630 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits...

CVE-2026-109630

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Due to insufficient permission checks on certain endpoints, authenticated attackers can perform unauthorized data access, reading information beyond the scope of their assigne...

CVE-2026-109630 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628

Frappe ERPNext versions prior to 15.121.0 and 16.x before 16.34.0 are susceptible to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce mandatory role checks when modifying record statuses, allowing authenticated low-privileged attackers to manipulate data outside ...

CVE-2026-109627

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 are affected by a missing authorization vulnerability (CWE-862). The flaw allows authenticated low-privileged users to access specific endpoints that fail to enforce proper permission checks. Exploiting this allows users to read fina...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109626

Frappe ERPNext versions prior to 16.34.2 are vulnerable to an SQL injection flaw due to missing input validation in multiple endpoints. Authenticated attackers with low privileges can exploit this by sending specially crafted requests to trigger the injection and extract sensitive information fro...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109625

Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce role-based authorization checks , allowing authenticated users to access and read financial data exceeding their assigned permissions. No spe...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109624

The Frappe ERPNext platform is vulnerable to a missing authorization flaw in specific endpoints, affecting versions before 15.120.0 and 16.x before 16.33.0 . The root cause is a failure to enforce proper permission checks, allowing authenticated low-privileged users to access and read personal da...

CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109622 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising da...

CVE-2026-109622 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising da...

CVE-2026-109622

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are affected by a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify data beyond their permitted roles. This flaw di...