Frappe ERPNext CVE-2026-109629

Requires a valid authenticated session on the target ERPNext site (PR:L) - any low-privilege user suffices, with no admin role or special permission needed - and the site must have a configured outgoing email account for transactional mail, which is the default for functional ERPNext deployments. Affected versions are ERPNext before 15.121.3 and 16.x before 16.35.0. No user interaction is required and the endpoint is network-reachable. The main limiting factors are the need for account access (self-registration or a compromised/insider credential) and that impact is confined to sending messages under the org identity - the flaw does not grant data read or system availability impact.

This is a genuine but moderate-severity issue, not a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 align with the description: a network-reachable, low-complexity flaw requiring only low-privilege authentication (any logged-in user) with no user interaction. Impact is narrow - VC:N/VA:N and only VI:L - reflecting that the attacker cannot read data or disrupt availability but can abuse the organisation's sending identity (integrity/trust impact via spoofed transactional email). No EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The real risk is reputational/phishing abuse (sending attacker-controlled messages as the org) rather than host compromise, so this should be patched on a normal cadence and prioritised where the ERPNext instance has many low-trust users or a valued sending domain - but it does not warrant emergency out-of-band response on raw severity alone. Note: the 'Authentication Bypass' tag is misleading - per CWE-862 and the description this is a missing-authorization flaw that itself REQUIRES an authenticated session (PR:L), not an authentication bypass.

An attacker registers or compromises any low-privilege account on an ERPNext site, then calls the unprotected transactional-email endpoint with an arbitrary recipient list and crafted body. Because the message is sent through the site's configured outgoing account, recipients receive attacker-controlled content bearing the organisation's trusted sending identity - ideal for phishing or impersonation. No public exploit code is referenced, but the attack is scriptable given a valid session.