Frappe ERPNext CVE-2026-109635

Requires an authenticated low-privilege portal user account (PR:L) on the target ERPNext instance - exploitation is not possible for fully anonymous attackers. The specific prerequisite is access to the affected document-creation endpoints that fail to verify the requesting portal user's ownership of the target party; any portal-enabled deployment (customer/supplier portal) running ERPNext before 15.105.0 or 16.x before 16.15.0 is exposed. The primary limiting factor is that the attacker must first possess a valid portal account, and the impact is confined to integrity (unauthorized document creation on behalf of other parties) with no direct confidentiality or availability effect; patching to 15.105.0 or 16.15.0 removes the flaw.

This is a genuine-but-moderate access-control flaw, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only a low-privilege authenticated portal account and no user interaction, which aligns with the CWE-862 (missing authorization) classification and the description of portal users creating documents on behalf of other parties. Impact is deliberately narrow: only VI:L (low integrity) is set, with confidentiality and availability marked N, so the realistic consequence is unauthorized/forged document creation rather than data theft or outage - the 5.3 score reflects this bounded impact. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no signal of active exploitation; this is a proactively disclosed VulnCheck/GHSA advisory rather than an in-the-wild threat. The signals are consistent (no conflict between CVSS and description), so the main limiting factor is the authentication requirement: an attacker must already hold a valid portal user account on the target instance.

An attacker who has registered or obtained a legitimate low-privilege portal (customer/supplier) account on an ERPNext instance sends crafted requests to the vulnerable document-creation endpoints, supplying a party identifier that is not their own. Because the endpoints never verify that the requesting portal user belongs to the target party, the attacker creates documents (e.g., on behalf of another customer or supplier), enabling data integrity abuse such as forged records or business-logic manipulation. No public exploit code was identified at the time of analysis, and exploitation requires a valid authenticated portal session.