Frappe ERPNext CVE-2026-109610

Exploitation requires a valid authenticated ERPNext session for a low-privileged user account (PR:L) - it is NOT remotely exploitable by anonymous/unauthenticated attackers. The attacker must reach specific affected endpoints that omit permission enforcement and directly submit document/data modification requests; no special non-default configuration or user interaction is stated as required. The limiting factors are therefore the need for pre-existing credentials and knowledge of the vulnerable endpoints, which confine realistic risk to malicious insiders or attackers who have already obtained low-privilege account access. Affected deployments are Frappe ERPNext before 15.119.1 and 16.x before 16.32.0.

This is a genuine but moderate-priority authorization flaw (CWE-862, Missing Authorization) rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) is internally consistent with the description: network-reachable, low attack complexity, requires an authenticated low-privileged account (PR:L), no user interaction, and the sole meaningful impact is high integrity (VI:H) - i.e. unauthorized modification of documents and data - with no confidentiality or availability impact. The score of 7.1 is driven almost entirely by the integrity impact combined with easy, authenticated network access. No EPSS score was provided, the CVE is NOT in CISA KEV, and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The practical gating factor is PR:L: an attacker must already hold a valid, if under-privileged, ERPNext account, which makes this far more relevant as an insider/post-compromise privilege-escalation issue than a pre-auth internet-wide threat. Signals are consistent (no conflicts between CVSS and description), but exploitation-probability and POC data are simply absent rather than contradictory.

A low-privileged but authenticated ERPNext user (for example a limited sales or support role, or an attacker who has phished/obtained such credentials) directly invokes one of the affected endpoints that skips its permission check. Because the server does not enforce the user's assigned role, the attacker modifies documents and records they should not be able to touch - altering financial, HR, or inventory data. No public POC is referenced, so exploitation would currently require independently identifying the specific unprotected endpoints.