CVE-2026-109654

Frappe ERPNext versions before 15.119.0 and 16.x before 16.31.0 are susceptible to a missing authorization vulnerability. Certain endpoints fail to verify if a caller has permission to read a specific document before initiating a transactional email. Consequently, authenticated attackers can trig...