EUVD-2026-98058

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext versions before 15.111.0 and 16.x before 16.22.0 are vulnerable to a privilege escalation vulnerability. The root cause is a record-creation endpoint that accepts the record type from the request and inserts the data with permission checks disabled . An authenticated user, even wit...