EUVD-2026-98059

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

EUVD-2026-98012

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records...

CVE-2026-109668

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

CVE-2026-109668

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are affected by a missing authorization vulnerability in specific endpoints handling party records . This flaw allows authenticated users with low-privileged accounts to perform unauthorized data modifications beyond their assigned r...

CVE-2026-109621 Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records...

CVE-2026-109621

Frappe ERPNext versions before 15.120.0 and 16.x before 16.23.0 are vulnerable to an authorization bypass (CWE-862). An endpoint incorrectly honors a caller-supplied flag that disables its own permission enforcement. This allows authenticated attackers to skip permission checks and access party r...