Frappe ERPNext CVE-2026-109637

Exploitation requires a valid authenticated ERPNext account with at least low privileges (CVSS PR:L); it is not reachable by fully anonymous attackers. The attacker must send requests to specific master-data endpoints that lack proper role-based authorization checks, allowing modification of master records beyond the account's assigned role. Limiting factors: a functioning user account is mandatory, impact is restricted to data integrity (no read access or service disruption), and only the affected versions before 16.14.0 are vulnerable, so upgrading removes the condition entirely.

This is a legitimate but moderate-priority access-control issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a network-reachable, low-complexity flaw requiring only low-privilege authenticated access and no user interaction - consistent with the CWE-862 missing-authorization root cause. Impact is confined to integrity (VI:H), with no confidentiality (VC:N) or availability (VA:N) effect, meaning an attacker can tamper with master data but cannot read secrets or disrupt service. No EPSS score, KEV listing, or POC was provided, so there is no public-exploitation signal: this appears to be a disclosure-driven finding (VulnCheck/GHSA advisory) rather than an actively exploited threat. The main caveat is that exploitation requires an existing authenticated account, which substantially limits the attacker population to insiders or already-compromised credentials; the 7.1 score reflects integrity damage potential, not ease of mass exploitation. Treat as a standard-cadence patch for ERPNext operators, prioritized higher in environments with many low-trust user accounts.

A low-privileged authenticated ERPNext user (e.g. a limited staff or portal account) discovers that certain master-data endpoints do not enforce role-based authorization. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, the user simply sends crafted requests directly to those endpoints and alters master records they were never granted permission to change. No public exploit code was identified at time of analysis, so this would require manual endpoint discovery.