Frappe CVE-2026-109599

Exploitation requires a valid authenticated session on the target Frappe/ERPNext instance (PR:L); the attacker must hold at least a low-privilege role and then reach the specific endpoints that omit role-based authorization enforcement. The concrete prerequisite is possession of any legitimate user account, after which crafted API requests to those endpoints allow modifying records outside the account's permitted scope. Limiting factors: no anonymous/unauthenticated path (an account is mandatory), no user interaction needed, and impact is confined to record modification (integrity) - there is no confidentiality disclosure or availability impact, and the flaw is fixed in 15.113.3 and 16.25.0.

This is a medium-severity broken-access-control flaw (CWE-862), and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 and describes a network-reachable, low-complexity attack that requires an authenticated low-privilege account (PR:L), with impact limited to integrity (VI:L) - no confidentiality or availability loss. This aligns cleanly with the description: authenticated users abusing endpoints that skip authorization checks to modify records beyond their role. No EPSS score, KEV listing, or public POC was provided, so this is not a confirmed-exploitation priority; it is a real but bounded privilege-escalation/data-tampering issue. The main thing keeping real-world risk moderate is the authentication requirement - an attacker needs a valid account on the target instance, so the threat is primarily insider or post-compromise lateral abuse rather than mass unauthenticated exploitation. EPSS/KEV/POC data is absent (not necessarily low - simply not supplied), so widespread opportunistic exploitation can be neither confirmed nor ruled out from the input.

A low-privilege authenticated user of a Frappe/ERPNext instance (e.g. a limited-role employee) crafts direct API requests to endpoints that fail to enforce role-based authorization, modifying records they should not be able to edit. No public exploit code was identified, and no user interaction or elevated privileges beyond a standard account are required, but a valid login is a prerequisite.