Frappe ERPNext CVE-2026-109630

Exploitation requires a valid authenticated ERPNext account (PR:L) - the attacker must already have login credentials or an active session as a lower-privileged user - and then calls the specific endpoints that fail to enforce role-based permission checks. There is no requirement for user interaction, no special non-default configuration is named in the advisory, and it affects ERPNext versions before 15.121.0 and 16.x before 16.34.0. The principal limiting factor is the authentication requirement: a fully anonymous external attacker cannot exploit this, and impact is confined to unauthorized reading of data (no modification), so the realistic exposure depends on how many untrusted or low-trust authenticated users exist in the deployment and how sensitive the role-restricted data is.

This is a medium-severity information-disclosure issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable but authenticated (PR:L) flaw with only low confidentiality impact and no integrity or availability impact, consistent with CWE-862 missing authorization - the attacker is already a legitimate low-privileged user who can reach endpoints returning data beyond their assigned role. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (no CVSS-vs-description conflict), and all point to a real but bounded horizontal/vertical read-access problem rather than a wormable critical. Priority should be driven by how sensitive the exposed data is in a given deployment and by the presence of untrusted authenticated users; it is a patch-in-normal-cycle issue absent additional exploitation signals.

A low-privileged but authenticated ERPNext user (for example a limited staff account or a self-registered portal user) directly calls the affected server endpoints that omit permission checks and retrieves records their role should not expose, such as HR, financial, or customer data. No public exploit code is referenced, but the attack requires only normal API access with valid credentials and low attack complexity, so it is straightforward for any insider or compromised account to reproduce.