Frappe ERPNext CVE-2026-109615

Requires a valid authenticated session as a low-privileged ERPNext user (PR:L) - the flaw is not reachable by unauthenticated attackers. The specific precondition is calling the affected document-creation endpoints that omit role-based permission enforcement during document creation. Exploitation is limited to deployments running ERPNext before 15.121.0 or 16.x before 16.34.0, and realistic exposure scales with how many low-privilege accounts (portal, employee, or customer self-service users) exist on the instance. No special non-default configuration is indicated by the description, and no user interaction is required (UI:N); impact is restricted to unauthorized document creation (integrity), not data disclosure or service disruption.

This is a genuine but moderate-priority access-control flaw, not a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means the attacker must already hold valid authenticated low-privileged credentials - this is a privilege/authorization escalation inside an existing session, not an unauthenticated breach. Impact is confined to integrity (VI:H): an attacker can create documents they should not be able to, with no confidentiality (VC:N) or availability (VA:N) consequence and no scope change (SC:N). No EPSS score, KEV listing, or public POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data means real-world exploitation likelihood cannot be quantified from these sources - this should not be read as 'low risk,' only as 'unmeasured.' The 7.1 score is driven entirely by high integrity impact and easy triggering once authenticated, which is consistent with a broken-access-control bug. Realistic priority: patch during normal cycles, prioritizing instances where low-privileged/self-service accounts (e.g., portal or employee users) are widely provisioned, since those populations are exactly the attacker precondition.

A low-privileged ERPNext user (for example a portal, employee, or self-service account) authenticates normally, then calls a document-creation endpoint that fails to re-check role permissions, allowing them to create records tied to roles or doctypes outside their granted scope. No public exploit code was identified in the provided intelligence, but exploitation requires only a valid low-privilege login and low attack complexity (AC:L). The result is unauthorized record creation and bypass of role-based access controls.