CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628

Frappe ERPNext versions prior to 15.121.0 and 16.x before 16.34.0 are susceptible to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce mandatory role checks when modifying record statuses, allowing authenticated low-privileged attackers to manipulate data outside ...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109626

Frappe ERPNext versions prior to 16.34.2 are vulnerable to an SQL injection flaw due to missing input validation in multiple endpoints. Authenticated attackers with low privileges can exploit this by sending specially crafted requests to trigger the injection and extract sensitive information fro...

CVE-2026-109627

Frappe ERPNext versions before 15.120.0 and 16.x before 16.33.0 are affected by a missing authorization vulnerability (CWE-862). The flaw allows authenticated low-privileged users to access specific endpoints that fail to enforce proper permission checks. Exploiting this allows users to read fina...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109625

Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce role-based authorization checks , allowing authenticated users to access and read financial data exceeding their assigned permissions. No spe...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned...

CVE-2026-109624

The Frappe ERPNext platform is vulnerable to a missing authorization flaw in specific endpoints, affecting versions before 15.120.0 and 16.x before 16.33.0 . The root cause is a failure to enforce proper permission checks, allowing authenticated low-privileged users to access and read personal da...

CVE-2026-109623

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role...

CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...