EUVD-2026-98018

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

EUVD-2026-98015

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits...

CVE-2026-109644

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what the...

CVE-2026-109627

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role...

CVE-2026-109669

The Frappe ERPNext software is vulnerable to a missing authorization flaw in versions prior to 15.110.0 and 16.x before 16.21.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying record statuses. This allows authenticated low-privileged users to ...

CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109624

The Frappe ERPNext platform is vulnerable to a missing authorization flaw in specific endpoints, affecting versions before 15.120.0 and 16.x before 16.33.0 . The root cause is a failure to enforce proper permission checks, allowing authenticated low-privileged users to access and read personal da...

CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109613

The Frappe ERPNext platform is affected by a missing authorization vulnerability (CWE-862) in versions prior to 15.121.0 and 16.x before 16.34.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying document statuses. This allows authenticated low-p...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-108853 UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

CVE-2026-108726

The GLPI application through version 12.0.0 is vulnerable to a missing authorization vulnerability in the ajax/map.php component. The root cause is the omission of the canView() check, which allows authenticated low-privileged users to search for itemtypes they are not authorized to view. By subm...

CVE-2026-108625

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any syssms record id to overwrite its title, content, receiv...

CVE-2026-101267

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-101267 Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-101267

A missing permission check allows low-privileged users who have access to an event, but lack access to its orders, to extract specific information. This vulnerability leads to a revenue information leak , exposing details such as the total revenue and the number of attendees . No specific softwar...

CVE-2026-101267 Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

PT-2026-102515

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...