CVE-2026-109658 Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits...

CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data...

CVE-2026-109656

Frappe ERPNext versions before 15.118.2 and 16.x before 16.30.0 are vulnerable to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce proper authorization checks on item master data . This allows authenticated attackers with low-privileged accounts to call these end...

CVE-2026-109655 Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their...

CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

CVE-2026-109655 Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their...

CVE-2026-109655

Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0 are vulnerable to a missing authorization flaw (CWE-862) in certain endpoints. The root cause is a failure to enforce proper role-based authorization checks , which allows authenticated low-privileged users to send requests that modi...

CVE-2026-109654

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are susceptible to a missing authorization vulnerability. Certain endpoints fail to verify if a caller has permission to read a specific document before initiating a transactional email. Consequently, authenticated attackers can trig...

CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned rol...

CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned rol...

CVE-2026-109650

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a missing authorization flaw (CWE-862). The root cause is that certain endpoints fail to enforce proper authorization checks, allowing authenticated low-privileged users to access and read personal data beyond their...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109647

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 are vulnerable to SQL injection across multiple endpoints. The root cause is missing input validation , which allows authenticated attackers to send specially crafted requests. This vulnerability enables the manipulation of database ...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109645

Frappe ERPNext versions prior to 15.119.0 and 16.x before 16.31.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers with low privileges to bypass role-based access restrictions. Exploiting this vu...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109644 Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what the...