Frappe ERPNext CVE-2026-109642

Exploitation requires a valid authenticated ERPNext session with at least a low-privilege role (CVSS PR:L) that can reach the affected endpoints - it is NOT exploitable by fully unauthenticated attackers. The condition is that certain endpoints omit server-side authorization enforcement, so any logged-in user can request data the role-based access control should restrict. Limiting factors: the attacker must already hold credentials on the target instance, impact is limited to reading data (no write/integrity or availability impact per VI:N/VA:N), and only the specific affected endpoints are exposed; instances with few or trusted authenticated users face correspondingly lower practical risk. Patched in ERPNext 15.110.0 and 16.21.0.

This is a medium-severity (CVSS 5.3, vendor-supplied CVSS 4.0 vector) missing-authorization flaw (CWE-862) in Frappe ERPNext. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, requires an authenticated low-privilege account (PR:L), no user interaction, and only a limited confidentiality impact (VC:L) with no integrity or availability impact - matching an information-disclosure-only bug where authenticated users read data beyond their assigned role. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic risk is therefore moderate-and-contained rather than urgent: the signals do not conflict, but exploitation presumes an attacker already holds valid credentials on the ERPNext instance, which caps the blast radius to unauthorized reads. This is a legitimate confidentiality/least-privilege issue to patch, not a high-priority internet-wide emergency; absent EPSS/KEV/POC data, prioritize based on exposure of the instance and sensitivity of the data the affected roles should not see.

A low-privilege authenticated ERPNext user (e.g., a limited role or a self-registered portal/customer account) directly queries the affected endpoints that fail to enforce authorization checks, returning records their role should not be able to see. No public exploit code was provided in the input, so the scenario is inferred from the description and CVSS vector (AV:N/AC:L/PR:L/UI:N). The result is unauthorized disclosure of business data such as other users' or departments' records.