CVE-2026-109616

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109615

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109614

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109613

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109611

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109610

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109598

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

CVE-2026-109599

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

CVE-2026-109672

Frappe ERPNext is vulnerable to a missing authorization vulnerability in certain endpoints prior to versions 15.118.0 and 16.27.0 . This flaw allows authenticated users to bypass role-based access controls and query endpoints to access sensitive financial data beyond their permitted privileges. N...

CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted...

CVE-2026-109669

The Frappe ERPNext software is vulnerable to a missing authorization flaw in versions prior to 15.110.0 and 16.x before 16.21.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying record statuses. This allows authenticated low-privileged users to ...

CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted...

CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

CVE-2026-109668

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are affected by a missing authorization vulnerability in specific endpoints handling party records . This flaw allows authenticated users with low-privileged accounts to perform unauthorized data modifications beyond their assigned r...

CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted...

CVE-2026-109666 Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assign...