https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 09:42:10 +0000 https://db.gcve.eu/vuln/cve-2026-109621 <p><strong>Affected:</strong> frappe erpnext</p> <p>Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.</p> <p><strong>Affected:</strong> frappe erpnext</p> <p>Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.</p> https://db.gcve.eu/vuln/cve-2026-109621