Frappe ERPNext CVE-2026-109651

Exploitation requires an authenticated session with a 'common operational role' that can write the vulnerable configuration field (PR:L) - it is not reachable by fully unauthenticated attackers, which is the primary limiting factor. The attacker must set this field to an arbitrary host, and exploitation value depends entirely on the deployment's internal network: the SSRF is only impactful if sensitive internal services (e.g., cloud metadata endpoints, internal APIs, databases) are reachable from the ERPNext application server. Affected versions are ERPNext before 15.112.0 and 16.x before 16.23.0; upgrading to a fixed release removes the condition. No non-default configuration is required beyond having an account with the relevant role.

This is a moderate, not urgent, priority. The authoritative CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 (Medium) and aligns well with the description: network-reachable, low complexity, no user interaction, but requiring low privileges (PR:L) consistent with the 'common operational roles' noted in the description. Impact is limited to confidentiality (VC:L) with no integrity or availability impact, matching a classic SSRF that reaches internal-only hosts rather than achieving code execution or data destruction. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified; absence of these is not evidence of safety but does mean there is no signal of active or widespread exploitation at this time. The signals are internally consistent - there is no CVSS-vs-description conflict here - but the real-world risk hinges on network topology: the flaw's value to an attacker is proportional to what internal services (metadata endpoints, admin panels, databases) are reachable from the ERPNext server. Treat this as a defense-in-depth patch item for a post-authentication SSRF, not a drop-everything emergency.

An attacker with a standard operational ERPNext account (not an administrator) edits the vulnerable configuration field, pointing it at an internal address such as a cloud metadata service or an internal admin interface. When ERPNext next issues its outbound request using that field, the server contacts the attacker-chosen internal host, allowing reconnaissance or retrieval of data from systems not otherwise reachable from the internet. No public exploit was identified in the provided data, and low attack complexity with no user interaction (AC:L/UI:N) means the action is straightforward once the attacker is authenticated.