Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108374 (GCVE-0-2026-108374)

Vulnerability from nvd – Published: 2026-10-16 20:38 – Updated: 2026-10-16 20:38

Title

ERPNext: Unauthorised status modification due to missing validation

Summary

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	x_refsource_CONFIRM
https://github.com/frappe/erpnext/commit/547d82da…	x_refsource_MISC
https://github.com/frappe/erpnext/commit/86e94803…	x_refsource_MISC
https://github.com/frappe/erpnext/commit/a20fc4f9…	x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v1…	x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v16.34.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: < 15.121.0 Affected: >= 16.0.0, < 16.34.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.121.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c 16.34.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user\u0027s permitted role. This issue is fixed in versions 15.121.0 and 16.34.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T20:38:32.806Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7"
        },
        {
          "name": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89"
        },
        {
          "name": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03"
        },
        {
          "name": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef"
        },
        {
          "name": "https://github.com/frappe/erpnext/releases/tag/v15.121.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/releases/tag/v15.121.0"
        },
        {
          "name": "https://github.com/frappe/erpnext/releases/tag/v16.34.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/releases/tag/v16.34.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5wpj-6rvp-9ff7",
        "discovery": "UNKNOWN"
      },
      "title": "ERPNext: Unauthorised status modification due to missing validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108374",
    "datePublished": "2026-10-16T20:38:32.806Z",
    "dateReserved": "2026-10-09T21:36:27.042Z",
    "dateUpdated": "2026-10-16T20:38:32.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108373 (GCVE-0-2026-108373)

Vulnerability from nvd – Published: 2026-10-16 20:48 – Updated: 2026-10-16 20:48

Title

ERPNext: Unauthorised access to financial data due to missing validation

Summary

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	x_refsource_CONFIRM
https://github.com/frappe/erpnext/commit/202f5227…	x_refsource_MISC
https://github.com/frappe/erpnext/commit/24f0989a…	x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v1…	x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v16.27.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: < 15.118.0 Affected: >= 16.0.0, < 16.27.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.118.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c 16.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user\u0027s document permission match conditions. This allows the user to read financial data beyond the user\u0027s permitted role. This issue is fixed in versions 15.118.0 and 16.27.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T20:48:46.241Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6"
        },
        {
          "name": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e"
        },
        {
          "name": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7"
        },
        {
          "name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
        },
        {
          "name": "https://github.com/frappe/erpnext/releases/tag/v16.27.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/erpnext/releases/tag/v16.27.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rgrq-243c-c4g6",
        "discovery": "UNKNOWN"
      },
      "title": "ERPNext: Unauthorised access to financial data due to missing validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-108373",
    "datePublished": "2026-10-16T20:48:46.241Z",
    "dateReserved": "2026-10-09T21:36:27.042Z",
    "dateUpdated": "2026-10-16T20:48:46.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109674 (GCVE-0-2026-109674)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:42

Title

Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation

Summary

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:42 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.98.0 (semver) Affected: 16.0.0-beta.1 , < 16.6.0 (semver) Unaffected: 15.98.0 (semver) Unaffected: 16.6.0 (semver)

Date Public

2026-03-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109674",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:42:23.684918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:42:34.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.98.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.6.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.98.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.6.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.98.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-03-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:38.179Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-wj7p-g62h-jh38)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-wj7p-g62h-jh38"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-16.6.0-sql-injection-via-missing-input-validation"
        }
      ],
      "title": "Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109674",
    "datePublished": "2026-10-12T22:22:38.179Z",
    "dateReserved": "2026-10-12T21:08:17.598Z",
    "dateUpdated": "2026-10-13T13:42:34.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109673 (GCVE-0-2026-109673)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44

Title

Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names

Summary

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:47 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.103.0 (semver) Affected: 16.0.0-beta.1 , < 16.12.0 (semver) Unaffected: 15.103.0 (semver) Unaffected: 16.12.0 (semver)

Date Public

2026-04-30 00:00

Credits

odgrso diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:47:58.088696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:44:26.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.103.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.12.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.103.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.12.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.103.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "odgrso"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-04-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users\u0027 browsers, enabling data access, modification, and token theft, especially against privileged users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:37.497Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-r99h-h44m-89m2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-r99h-h44m-89m2"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-16.12.0-stored-xss-via-crafted-record-names"
        }
      ],
      "title": "Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109673",
    "datePublished": "2026-10-12T22:22:37.497Z",
    "dateReserved": "2026-10-12T21:08:17.598Z",
    "dateUpdated": "2026-10-13T16:44:26.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109672 (GCVE-0-2026-109672)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 13:56

Title

Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data

Summary

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 13:54 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.118.0 (semver) Affected: 16.0.0-beta.1 , < 16.27.0 (semver) Unaffected: 15.118.0 (semver) Unaffected: 16.27.0 (semver)

Date Public

2026-08-13 00:00

Credits

0xPugal snoopysecurity

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T13:54:57.825135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T13:56:50.572Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.118.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.27.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.118.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.118.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.27.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0xPugal"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "snoopysecurity"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:36.829Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rgrq-243c-c4g6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data"
        }
      ],
      "title": "Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109672",
    "datePublished": "2026-10-12T22:22:36.829Z",
    "dateReserved": "2026-10-12T21:08:17.598Z",
    "dateUpdated": "2026-10-14T13:56:50.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109671 (GCVE-0-2026-109671)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:35

Title

Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages

Summary

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.113.0 (semver) Affected: 16.0.0-beta.1 , < 16.24.0 (semver) Unaffected: 15.113.0 (semver) Unaffected: 16.24.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:34:27.562780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:35:57.389Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.113.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.24.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.113.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.24.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.113.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.24.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:36.142Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rg9g-c26v-cw27)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-rg9g-c26v-cw27"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-stored-xss-via-profile-field-in-portal-pages"
        }
      ],
      "title": "Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109671",
    "datePublished": "2026-10-12T22:22:36.142Z",
    "dateReserved": "2026-10-12T21:08:17.598Z",
    "dateUpdated": "2026-10-15T14:35:57.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109670 (GCVE-0-2026-109670)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-12 22:22

Title

Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name

Summary

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.110.0 (semver) Affected: 16.0.0-beta.1 , < 16.21.0 (semver) Unaffected: 15.110.0 (semver) Unaffected: 16.21.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha utkusen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.110.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.21.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.110.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.21.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.110.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.21.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "utkusen"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:35.500Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m6x2-278g-pv2g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-m6x2-278g-pv2g"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-stored-xss-via-item-record-name"
        }
      ],
      "title": "Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109670",
    "datePublished": "2026-10-12T22:22:35.500Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-12T22:22:35.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109669 (GCVE-0-2026-109669)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:43

Title

Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

Summary

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:42 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.110.0 (semver) Affected: 16.0.0-beta.1 , < 16.21.0 (semver) Unaffected: 15.110.0 (semver) Unaffected: 16.21.0 (semver)

Date Public

2026-08-13 00:00

Credits

NSSYS AntarikshaAkhileshSharma alaeddine03 vnth4nhnt diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109669",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:42:52.756642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:43:02.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.110.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.21.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.110.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.21.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.110.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.21.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NSSYS"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "AntarikshaAkhileshSharma"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "alaeddine03"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:34.830Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6m66-w2qq-v5f8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-6m66-w2qq-v5f8"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-allows-unauthorized-status-modification"
        }
      ],
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109669",
    "datePublished": "2026-10-12T22:22:34.830Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-13T13:43:02.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109668 (GCVE-0-2026-109668)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44

Title

Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints

Summary

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:48 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.110.0 (semver) Affected: 16.0.0-beta.1 , < 16.21.0 (semver) Unaffected: 15.110.0 (semver) Unaffected: 16.21.0 (semver)

Date Public

2026-08-13 00:00

Credits

NSSYS vnth4nhnt diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:00.690419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:44:32.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.110.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.21.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.110.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.21.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.110.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.21.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NSSYS"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:34.237Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5mcx-cjjh-gc64)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-5mcx-cjjh-gc64"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-party-record-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109668",
    "datePublished": "2026-10-12T22:22:34.237Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-13T16:44:32.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109667 (GCVE-0-2026-109667)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:41

Title

Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Summary

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 12:38 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.111.0 (semver) Affected: 16.0.0-beta.1 , < 16.22.0 (semver) Unaffected: 15.111.0 (semver) Unaffected: 16.22.0 (semver)

Date Public

2026-08-13 00:00

Credits

NSSYS aramosf vnth4nhnt Shllokkk prakhar0x01

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T12:38:37.628102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T12:41:30.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.111.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.22.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.111.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.22.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.111.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.22.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NSSYS"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "aramosf"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Shllokkk"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "prakhar0x01"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:33.562Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-x635-wr4c-7345)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-x635-wr4c-7345"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.111.0-privilege-escalation-via-unauthorized-record-creation"
        }
      ],
      "title": "Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109667",
    "datePublished": "2026-10-12T22:22:33.562Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-14T12:41:30.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109666 (GCVE-0-2026-109666)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:33

Title

Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints

Summary

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:33 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.110.0 (semver) Affected: 16.0.0-beta.1 , < 16.21.0 (semver) Unaffected: 15.110.0 (semver) Unaffected: 16.21.0 (semver)

Date Public

2026-08-13 00:00

Credits

NSSYS diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:33:09.927396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:33:53.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.110.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.21.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.110.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.21.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.110.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.21.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NSSYS"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:32.901Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6rgf-xx2m-fjr2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-6rgf-xx2m-fjr2"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-inventory-record-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109666",
    "datePublished": "2026-10-12T22:22:32.901Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-15T14:33:53.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109665 (GCVE-0-2026-109665)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-12 22:22

Title

Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Summary

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.108.0 (semver) Affected: 16.0.0-beta.1 , < 16.18.0 (semver) Unaffected: 15.108.0 (semver) Unaffected: 16.18.0 (semver)

Date Public

2026-08-13 00:00

Credits

NSSYS vnth4nhnt diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.108.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.18.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.108.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.108.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.18.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "NSSYS"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:32.224Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-j57j-p235-x5mx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-j57j-p235-x5mx"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.108.0-missing-authorization-allows-master-record-deactivation"
        }
      ],
      "title": "Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109665",
    "datePublished": "2026-10-12T22:22:32.224Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-12T22:22:32.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109664 (GCVE-0-2026-109664)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:43

Title

Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification

Summary

Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:43 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.112.0 (semver) Unaffected: 15.112.0 (semver) cpe:2.3:a:frappe:erpnext::::::::

Date Public

2026-08-13 00:00

Credits

skjbulcher

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:43:23.180405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:43:33.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.112.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.112.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.112.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "skjbulcher"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role\u0027s permissions, tampering with data they should not control."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:31.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-f7x9-qfrf-92m8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-f7x9-qfrf-92m8"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-allows-arbitrary-record-modification"
        }
      ],
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109664",
    "datePublished": "2026-10-12T22:22:31.573Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-13T13:43:33.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109663 (GCVE-0-2026-109663)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44

Title

Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters

Summary

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:48 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.113.0 (semver) Affected: 16.0.0-beta.1 , < 16.22.0 (semver) Unaffected: 15.113.0 (semver) Unaffected: 16.22.0 (semver)

Date Public

2026-08-13 00:00

Credits

ankush muztahidultanim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:06.566459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:44:40.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.113.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.22.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.113.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.22.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.113.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.22.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ankush"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "muztahidultanim"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:30.876Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gwfr-5r8f-rwg4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-gwfr-5r8f-rwg4"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-sql-injection-via-unvalidated-endpoint-parameters"
        }
      ],
      "title": "Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109663",
    "datePublished": "2026-10-12T22:22:30.876Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-13T16:44:40.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109662 (GCVE-0-2026-109662)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:37

Title

Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form

Summary

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 12:37 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.112.0 (semver) Affected: 16.0.0-beta.1 , < 16.23.0 (semver) Unaffected: 15.112.0 (semver) Unaffected: 16.23.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha muztahidultanim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T12:37:25.322877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T12:37:39.019Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.112.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.23.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.112.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.23.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.112.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.23.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "muztahidultanim"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:30.244Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4rfh-2hfg-9m7w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-4rfh-2hfg-9m7w"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-stored-xss-via-public-portal-form"
        }
      ],
      "title": "Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109662",
    "datePublished": "2026-10-12T22:22:30.244Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-14T12:37:39.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109661 (GCVE-0-2026-109661)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:32

Title

Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data

Summary

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:32 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.116.0 (semver) Affected: 16.0.0-beta.1 , < 16.27.0 (semver) Unaffected: 15.116.0 (semver) Unaffected: 16.27.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha Solidscripting

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109661",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:32:15.726937Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:32:33.162Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.116.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.27.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.116.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.116.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.27.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Solidscripting"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:29.645Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-j2h8-8xqj-jrg9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-j2h8-8xqj-jrg9"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.116.0-missing-authorization-exposes-financial-data"
        }
      ],
      "title": "Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109661",
    "datePublished": "2026-10-12T22:22:29.645Z",
    "dateReserved": "2026-10-12T21:07:34.160Z",
    "dateUpdated": "2026-10-15T14:32:33.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109660 (GCVE-0-2026-109660)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-12 22:22

Title

Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints

Summary

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.112.0 (semver) Affected: 16.0.0-beta.1 , < 16.23.0 (semver) Unaffected: 15.112.0 (semver) Unaffected: 16.23.0 (semver)

Date Public

2026-08-13 00:00

Credits

soulxone

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.112.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.23.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.112.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.23.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.112.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.23.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "soulxone"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:28.973Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fmr9-rm6j-cfpq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-fmr9-rm6j-cfpq"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-in-production-record-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109660",
    "datePublished": "2026-10-12T22:22:28.973Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-12T22:22:28.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109659 (GCVE-0-2026-109659)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:42

Title

Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

Summary

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:41 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.113.0 (semver) Affected: 16.0.0-beta.1 , < 16.24.0 (semver) Unaffected: 15.113.0 (semver) Unaffected: 16.24.0 (semver)

Date Public

2026-08-13 00:00

Credits

Santoshkumarpuppala vnth4nhnt diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:41:54.416726Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:42:03.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.113.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.24.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.113.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.24.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.113.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.24.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Santoshkumarpuppala"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:28.377Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9pj9-fm7x-r62h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-9pj9-fm7x-r62h"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-missing-authorization-exposes-financial-data"
        }
      ],
      "title": "Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109659",
    "datePublished": "2026-10-12T22:22:28.377Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-13T13:42:03.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109658 (GCVE-0-2026-109658)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44

Title

Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints

Summary

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:48 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.115.0 (semver) Affected: 16.0.0-beta.1 , < 16.26.0 (semver) Unaffected: 15.115.0 (semver) Unaffected: 16.26.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109658",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:11.032214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:44:47.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.115.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.26.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.115.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.115.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.26.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:27.775Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gq9h-847p-h692)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-gq9h-847p-h692"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-on-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109658",
    "datePublished": "2026-10-12T22:22:27.775Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-13T16:44:47.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109657 (GCVE-0-2026-109657)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:36

Title

Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name

Summary

Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 12:35 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 16.0.0-beta.1 , < 16.27.0 (semver) Unaffected: 16.27.0 (semver) cpe:2.3:a:frappe:erpnext::::::::

Date Public

2026-08-13 00:00

Credits

nikkothari22

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109657",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T12:35:41.732284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T12:36:34.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "16.27.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.27.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "nikkothari22"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:27.164Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mvr5-2j8r-53p4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-mvr5-2j8r-53p4"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-16-x-before-16.27.0-stored-xss-via-unescaped-record-name"
        }
      ],
      "title": "Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109657",
    "datePublished": "2026-10-12T22:22:27.164Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-14T12:36:34.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109656 (GCVE-0-2026-109656)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:31

Title

Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access

Summary

Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:31 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.118.2 (semver) Affected: 16.0.0-beta.1 , < 16.30.0 (semver) Unaffected: 15.118.2 (semver) Unaffected: 16.30.0 (semver)

Date Public

2026-08-13 00:00

Credits

vnth4nhnt diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:31:18.407394Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:31:39.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.118.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.30.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.118.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.30.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.118.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.30.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:26.493Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4j82-w8f7-hqqp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-4j82-w8f7-hqqp"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.2-unauthorized-item-master-data-access"
        }
      ],
      "title": "Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109656",
    "datePublished": "2026-10-12T22:22:26.493Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-15T14:31:39.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109655 (GCVE-0-2026-109655)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-12 22:22

Title

Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints

Summary

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.115.0 (semver) Affected: 16.0.0-beta.1 , < 16.26.0 (semver) Unaffected: 15.115.0 (semver) Unaffected: 16.26.0 (semver)

Date Public

2026-08-13 00:00

Credits

vnth4nhnt Priyal208

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.115.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.26.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.115.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.115.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.26.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Priyal208"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:25.822Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fhc6-v53v-3wjx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-fhc6-v53v-3wjx"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-in-inventory-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109655",
    "datePublished": "2026-10-12T22:22:25.822Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-12T22:22:25.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109654 (GCVE-0-2026-109654)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:41

Title

Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

Summary

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:41 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.119.0 (semver) Affected: 16.0.0-beta.1 , < 16.31.0 (semver) Unaffected: 15.119.0 (semver) Unaffected: 16.31.0 (semver)

Date Public

2026-08-13 00:00

Credits

hotplugin0x01 diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:41:14.152780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:41:24.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.119.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.31.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.119.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.119.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.31.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hotplugin0x01"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:25.155Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q8wq-q35q-gj8h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-q8wq-q35q-gj8h"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.0-missing-authorization-in-transactional-email-endpoints"
        }
      ],
      "title": "Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109654",
    "datePublished": "2026-10-12T22:22:25.155Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-13T13:41:24.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109653 (GCVE-0-2026-109653)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:44

Title

Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover

Summary

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:48 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.119.0 (semver) Affected: 16.0.0-beta.1 , < 16.31.0 (semver) Unaffected: 15.119.0 (semver) Unaffected: 16.31.0 (semver)

Date Public

2026-08-13 00:00

Credits

hotplugin0x01 diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:13.226339Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:44:54.431Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.119.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.31.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.119.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.119.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.31.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "hotplugin0x01"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:24.555Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-8pr6-r75h-h8xx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-8pr6-r75h-h8xx"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.0-stored-xss-leading-to-account-takeover"
        }
      ],
      "title": "Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109653",
    "datePublished": "2026-10-12T22:22:24.555Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-13T16:44:54.431Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109652 (GCVE-0-2026-109652)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:34

Title

Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields

Summary

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 12:30 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.119.1 (semver) Affected: 16.0.0-beta.1 , < 16.32.0 (semver) Unaffected: 15.119.1 (semver) Unaffected: 16.32.0 (semver)

Date Public

2026-08-13 00:00

Credits

diptanilsaha mtholmquist vnth4nhnt bugbunny-research lukasz-rybak

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109652",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T12:30:43.392616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T12:34:25.896Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.119.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.32.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.119.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.119.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.32.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "mtholmquist"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "bugbunny-research"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "lukasz-rybak"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:23.915Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6w83-8777-v93q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-6w83-8777-v93q"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-server-side-template-injection-via-message-fields"
        }
      ],
      "title": "Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109652",
    "datePublished": "2026-10-12T22:22:23.915Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-14T12:34:25.896Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109651 (GCVE-0-2026-109651)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-15 14:30

Title

Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field

Summary

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:30 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.112.0 (semver) Affected: 16.0.0-beta.1 , < 16.23.0 (semver) Unaffected: 15.112.0 (semver) Unaffected: 16.23.0 (semver)

Date Public

2026-08-13 00:00

Credits

prakhar0x01 diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109651",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:30:00.581746Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T14:30:30.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.112.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.23.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.112.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.23.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.112.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.23.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "prakhar0x01"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment\u0027s network."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:23.264Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6qcc-cw7f-328g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-6qcc-cw7f-328g"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-server-side-request-forgery-via-configuration-field"
        }
      ],
      "title": "Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109651",
    "datePublished": "2026-10-12T22:22:23.264Z",
    "dateReserved": "2026-10-12T21:06:47.173Z",
    "dateUpdated": "2026-10-15T14:30:30.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109650 (GCVE-0-2026-109650)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-12 22:22

Title

Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Summary

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.112.0 (semver) Affected: 16.0.0-beta.1 , < 16.23.0 (semver) Unaffected: 15.112.0 (semver) Unaffected: 16.23.0 (semver)

Date Public

2026-08-13 00:00

Credits

FredrikEV

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.112.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.23.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.112.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.23.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.112.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.23.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "FredrikEV"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:22.629Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-39rf-vr57-g568)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-39rf-vr57-g568"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-exposes-personal-data"
        }
      ],
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109650",
    "datePublished": "2026-10-12T22:22:22.629Z",
    "dateReserved": "2026-10-12T21:05:57.847Z",
    "dateUpdated": "2026-10-12T22:22:22.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109649 (GCVE-0-2026-109649)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 13:40

Title

Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Summary

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 13:40 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.102.0 (semver) Affected: 16.0.0-beta.1 , < 16.11.0 (semver) Unaffected: 15.102.0 (semver) Unaffected: 16.11.0 (semver)

Date Public

2026-08-13 00:00

Credits

odgrso diptanilsaha thesanjok

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T13:40:39.458620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T13:40:50.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.102.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.11.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.102.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.102.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.11.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "odgrso"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "thesanjok"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:21.935Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9ph8-h5v4-97j6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-9ph8-h5v4-97j6"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.102.0-sql-injection-via-unvalidated-endpoint-requests-2"
        }
      ],
      "title": "Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109649",
    "datePublished": "2026-10-12T22:22:21.935Z",
    "dateReserved": "2026-10-12T21:05:57.847Z",
    "dateUpdated": "2026-10-13T13:40:50.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109648 (GCVE-0-2026-109648)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-13 16:45

Title

Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Summary

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 15:48 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.106.0 (semver) Affected: 16.0.0-beta.1 , < 16.16.0 (semver) Unaffected: 15.106.0 (semver) Unaffected: 16.16.0 (semver)

Date Public

2026-08-13 00:00

Credits

odgrso diptanilsaha vnth4nhnt

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109648",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T15:48:15.157802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T16:45:02.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.106.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.16.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.106.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.106.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.16.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "odgrso"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "vnth4nhnt"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:21.280Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q85h-wj57-hq2h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-q85h-wj57-hq2h"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.106.0-sql-injection-via-missing-input-validation"
        }
      ],
      "title": "Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109648",
    "datePublished": "2026-10-12T22:22:21.280Z",
    "dateReserved": "2026-10-12T21:05:57.847Z",
    "dateUpdated": "2026-10-13T16:45:02.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109647 (GCVE-0-2026-109647)

Vulnerability from nvd – Published: 2026-10-12 22:22 – Updated: 2026-10-14 12:28

Title

Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Summary

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 12:28 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/erpnext/security/adviso…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-erpne…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	erpnext	Affected: 0 , < 15.106.0 (semver) Affected: 16.0.0-beta.1 , < 16.16.0 (semver) Unaffected: 15.106.0 (semver) Unaffected: 16.16.0 (semver)

Date Public

2026-08-13 00:00

Credits

odgrso diptanilsaha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109647",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T12:28:01.032422Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T12:28:45.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "erpnext",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.106.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.16.0",
              "status": "affected",
              "version": "16.0.0-beta.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.106.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "15.106.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.16.0",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "odgrso"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "diptanilsaha"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T22:22:20.612Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h68p-2phh-vh26)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/erpnext/security/advisories/GHSA-h68p-2phh-vh26"
        },
        {
          "name": "VulnCheck Advisory: Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.106.0-sql-injection-via-missing-validation-2"
        }
      ],
      "title": "Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-109647",
    "datePublished": "2026-10-12T22:22:20.612Z",
    "dateReserved": "2026-10-12T21:05:57.847Z",
    "dateUpdated": "2026-10-14T12:28:45.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

144 vulnerabilities found for erpnext by frappe

CVE-2026-108374 (GCVE-0-2026-108374)

CVE-2026-108373 (GCVE-0-2026-108373)

CVE-2026-109674 (GCVE-0-2026-109674)

CVE-2026-109673 (GCVE-0-2026-109673)

CVE-2026-109672 (GCVE-0-2026-109672)

CVE-2026-109671 (GCVE-0-2026-109671)

CVE-2026-109670 (GCVE-0-2026-109670)

CVE-2026-109669 (GCVE-0-2026-109669)

CVE-2026-109668 (GCVE-0-2026-109668)

CVE-2026-109667 (GCVE-0-2026-109667)

CVE-2026-109666 (GCVE-0-2026-109666)

CVE-2026-109665 (GCVE-0-2026-109665)

CVE-2026-109664 (GCVE-0-2026-109664)

CVE-2026-109663 (GCVE-0-2026-109663)

CVE-2026-109662 (GCVE-0-2026-109662)

CVE-2026-109661 (GCVE-0-2026-109661)

CVE-2026-109660 (GCVE-0-2026-109660)

CVE-2026-109659 (GCVE-0-2026-109659)

CVE-2026-109658 (GCVE-0-2026-109658)

CVE-2026-109657 (GCVE-0-2026-109657)

CVE-2026-109656 (GCVE-0-2026-109656)

CVE-2026-109655 (GCVE-0-2026-109655)

CVE-2026-109654 (GCVE-0-2026-109654)

CVE-2026-109653 (GCVE-0-2026-109653)

CVE-2026-109652 (GCVE-0-2026-109652)

CVE-2026-109651 (GCVE-0-2026-109651)

CVE-2026-109650 (GCVE-0-2026-109650)

CVE-2026-109649 (GCVE-0-2026-109649)

CVE-2026-109648 (GCVE-0-2026-109648)

CVE-2026-109647 (GCVE-0-2026-109647)