CVE-2026-109654

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are susceptible to a missing authorization vulnerability. Certain endpoints fail to verify if a caller has permission to read a specific document before initiating a transactional email. Consequently, authenticated attackers can trig...

CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactiona...

CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned rol...

CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned rol...

CVE-2026-109650

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a missing authorization flaw (CWE-862). The root cause is that certain endpoints fail to enforce proper authorization checks, allowing authenticated low-privileged users to access and read personal data beyond their...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109647

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 are vulnerable to SQL injection across multiple endpoints. The root cause is missing input validation , which allows authenticated attackers to send specially crafted requests. This vulnerability enables the manipulation of database ...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109645

Frappe ERPNext versions prior to 15.119.0 and 16.x before 16.31.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers with low privileges to bypass role-based access restrictions. Exploiting this vu...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109644 Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what the...

CVE-2026-109644

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are affected by a missing authorization vulnerability (CWE-862 ). The root cause is a failure to enforce proper authorization checks on certain endpoints, which allows authenticated low-privileged users to query and read valuation in...

CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109642 Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits...

CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned...

CVE-2026-109643

Frappe ERPNext versions before 15.111.0 and 16.x before 16.22.0 are affected by a missing authorization vulnerability (CWE-862) in specific project-related endpoints. The root cause is a failure to enforce proper permission checks, allowing authenticated low-privileged users to directly access an...

CVE-2026-109642

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a missing authorization vulnerability (CWE-862). The root cause is a failure to enforce proper authorization checks on certain endpoints, allowing authenticated users to query these endpoints and access data beyond ...

CVE-2026-109642 Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits...