CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator h...

CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator h...

CVE-2026-109641

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are susceptible to a missing authorization vulnerability (CWE-862). Specific endpoints fail to enforce proper authorization checks, allowing unauthenticated remote attackers to call these endpoints to create records and enumerate ava...

CVE-2026-109640

Frappe ERPNext versions before 16.22.0 are susceptible to a missing authorization vulnerability (CWE-862). The flaw allows authenticated users to bypass permission checks by invoking specific endpoints that lack proper authorization logic. Consequently, an attacker with low-level privileges can p...

CVE-2026-109640 Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification

Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in...

CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records...

CVE-2026-109638 Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-109637

Frappe ERPNext versions before 16.14.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass role-based restrictions and perform unauthorized modifications to master data records. The issue stems from specific endpoints lacking proper a...

CVE-2026-109638

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a SQL injection flaw in certain endpoints. The root cause is missing input validation , which allows authenticated attackers to submit specially crafted requests to manipulate database queries. This vulnerability ca...

CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted rol...

CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted rol...

CVE-2026-109636

Frappe ERPNext versions before 15.115.0 and 16.x before 16.26.0 are susceptible to a missing authorization vulnerability (CWE-862). Certain endpoints fail to enforce adequate permission checks, allowing authenticated attackers with low-privileged accounts to access and read financial data exceedi...

CVE-2026-109635

Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 are vulnerable to a missing authorization flaw (CWE-862). Certain document creation endpoints fail to verify if a requesting portal user belongs to the target party. This allows authenticated portal users to create documents on behal...

CVE-2026-109635 Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create...

CVE-2026-109632 Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits...

CVE-2026-109632

The Frappe ERPNext software versions before 15.121.0 and 16.x before 16.33.0 are susceptible to a missing authorization vulnerability (CWE-862). The root cause is a failure to enforce proper authorization checks on certain endpoints. This allows authenticated users to directly call these endpoint...

CVE-2026-109632 Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits...

CVE-2026-109630 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits...

CVE-2026-109629 Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...