CVE-2026-109651

Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw stems from a configuration field, writable by common operational roles, that fails to validate arbitrary outbound request destinations. An authenticated attacker can m...