CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109614

Frappe ERPNext versions prior to 16.34.0 are susceptible to a missing authorization vulnerability (CWE-862). This flaw allows authenticated users to bypass intended role restrictions and query endpoints that lack proper access controls. Consequently, attackers can access sensitive financial recor...

CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond...

CVE-2026-109615

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks during document creation, allowing authenticated low-privileged users to create documents against records outside th...

CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109613

The Frappe ERPNext platform is affected by a missing authorization vulnerability (CWE-862) in versions prior to 15.121.0 and 16.x before 16.34.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying document statuses. This allows authenticated low-p...

CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their...

CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109611

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to call these endpoints and modify data beyond the scope of their assigned roles. E...

CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109610

The Frappe ERPNext software versions prior to 15.119.1 and 16.x before 16.32.0 are vulnerable to a missing authorization flaw. The root cause is that certain endpoints fail to enforce proper permission checks, allowing authenticated low-privileged users to call these endpoints. Exploitation of th...

CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permit...

CVE-2026-109599

Frappe versions before 15.113.3 and 16.x before 16.25.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper authorization checks, allowing authenticated users to send requests that modify records beyond the permissions of their assigned roles. No spe...

CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits...

CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2019-19652

CVE-2019-19652 Chevereto downgrade attack - 1.0.0 - 1.1.4 Free, = 3.13.5 Core. An admin user can instruct the updater script to downgrade to another version instead of upgrade, reintroducing previous flaws. Due to the lack of a CSRF token this attack can also be used in a CSRF attack, meaning an...