Frappe ERPNext CVE-2026-109625

Requires a valid authenticated ERPNext account with any assigned role (PR:L); the attacker then requests specific endpoints that fail to enforce role-based authorization checks to read financial data beyond their granted permissions. Affected deployments are Frappe ERPNext versions before 15.121.3 and 16.x before 16.35.0. No special non-default configuration or user interaction is required, and exploitation is network-reachable, but access is limited to users who already possess credentials - there is no unauthenticated path, which confines realistic risk to malicious insiders or attackers holding stolen/weak low-privilege accounts.

This is a missing-authorization flaw (CWE-862) in Frappe ERPNext where certain endpoints fail to enforce role-based checks, letting authenticated users read financial data beyond their assigned role. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent: remote, low-complexity, requires a valid low-privilege account, no user interaction, with high confidentiality impact and no integrity or availability impact - a pure horizontal/vertical data-disclosure issue rather than a system-compromise vector. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so there is no public evidence of active exploitation or weaponization; exploitation probability signals are absent, not low. Risk is therefore moderate and conditional: the PR:L requirement means an attacker must already hold an authenticated ERPNext account, which substantially limits exposure to insiders or attackers who have obtained credentials, but once that bar is met exploitation is trivial (AC:L, no special conditions) and exposes sensitive financial records. Treat as a meaningful priority for organizations running ERPNext with many low-trust user accounts, but it is not an unauthenticated internet-wide emergency; the absence of integrity/availability impact and the authentication requirement keep it below the top-tier critical bucket despite the 7.1 base score.

A low-privileged but authenticated ERPNext user (for example a sales or support account) sends a direct request to one of the affected endpoints that omits role-based authorization enforcement. Because the endpoint only checks that the user is logged in and not that their role grants access, the server returns financial data the user was never authorized to see, enabling insider data theft. No public exploit code is referenced, so exploitation would require manually identifying the vulnerable endpoints.