Frappe ERPNext CVE-2026-109644

The attacker must hold a valid, authenticated ERPNext account with at least a low-privileged role (PR:L) and network access to the application's endpoints; no admin rights, user interaction, or non-default configuration is indicated. Exploitation targets specific valuation-data endpoints that fail to enforce role-based authorization, so it is scoped to reading valuation/stock-costing information rather than arbitrary data. The primary limiting factor is the authentication requirement - unauthenticated outsiders cannot exploit this - which makes it chiefly an insider or compromised-low-privilege-account risk in multi-user or multi-tenant ERPNext installations on versions below 15.119.0 or 16.31.0.

This is a missing authorization flaw (CWE-862) in Frappe ERPNext valuation endpoints. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and indicates a network-reachable, low-complexity attack requiring low-privilege authentication (PR:L), with impact confined to confidentiality (VC:H) - no integrity or availability effect. This is consistent with the description: an already-authenticated low-privileged user reads valuation data beyond their role, i.e. a horizontal/vertical information-disclosure issue rather than remote takeover. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is moderate and insider-/tenant-centric: an attacker must first hold a valid ERPNext account, which sharply limits mass exploitation, but once authenticated the low complexity and lack of required user interaction make the data read reliable. This is a genuine confidentiality-of-business-data concern for multi-user ERPNext deployments, not a wormable internet-facing critical. Note the input Tags label this 'Authentication Bypass', which conflicts with the CWE-862 classification and the description - it is an authorization (access-control) flaw against authenticated users, not an authentication bypass.

A low-privileged employee or external user with any valid ERPNext login directly queries the affected valuation endpoints that omit role-based authorization checks, retrieving item/stock valuation figures their assigned role should not expose. No exploit code is provided in the input, and the attack needs only normal authenticated API/HTTP access with no special tooling or user interaction.