CVE-2026-109622 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising da...

CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against...

CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against...

CVE-2026-109617

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are affected by a missing authorization vulnerability (CWE-862) in certain endpoints. The root cause is a failure to enforce proper authorization checks during document creation. This allows authenticated low-privileged users to bypa...

CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109616

The Frappe ERPNext application is vulnerable to a missing authorization flaw in versions prior to 15.121.3 and 16.x before 16.35.0 . The root cause is that certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify data beyond the perm...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109614

Frappe ERPNext versions prior to 16.34.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass intended role restrictions and query endpoints that lack proper access controls. Consequently, attackers can access sensitive financial recor...

CVE-2026-109615

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks during document creation, allowing authenticated low-privileged users to create documents against records outside th...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109613

The Frappe ERPNext platform is affected by a missing authorization vulnerability (CWE-862) in versions prior to 15.121.0 and 16.x before 16.34.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying document statuses. This allows authenticated low-p...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109611

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to call these endpoints and modify data beyond the scope of their assigned roles. E...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...