CVE-2026-109635

Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 are vulnerable to a missing authorization flaw (CWE-862). Certain document creation endpoints fail to verify if a requesting portal user belongs to the target party. This allows authenticated portal users to create documents on behal...