CVE-2026-109669

The Frappe ERPNext software is vulnerable to a missing authorization flaw in versions prior to 15.110.0 and 16.x before 16.21.0 . The root cause is that certain endpoints fail to enforce proper authorization checks when modifying record statuses. This allows authenticated low-privileged users to ...