Frappe ERPNext CVE-2026-109652

Requires an authenticated session as a user holding a 'common operational role' (PR:L) - not administrative access - which is a low bar because such roles are routinely assigned to ordinary ERPNext business users. The specific attack surface is user-controlled message fields that are passed to template rendering without validation, so exploitation works against default rendering behavior of unpatched versions (ERPNext before 15.119.1 and 16.x before 16.32.0); no special non-default configuration is named as required. Limiting factors: the attacker must first obtain valid credentials with the operational role, and the primary mitigation is upgrading to a fixed version (15.119.1 / 16.32.0 or later).

This is a credible, actionable priority rather than an inflated high-CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low privileges - and the description confirms those privileges are a 'common operational role,' meaning the authentication barrier is weak in practice since such roles are routinely granted to ordinary business users. The VC:H/VI:H/VA:H impact triad is consistent with the described capability to read and write arbitrary database data, delete documents, send outbound requests, and send mail, which is near-total compromise of the application's data and trust boundary. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass-scanning pressure at this time; the risk is driven by the intrinsic ease and impact of the flaw, not by observed in-the-wild activity. Signals are internally consistent (no CVSS-versus-description conflict), with the main caveat being that only a CVSS 4.0 vector was supplied - no CVSS 3.1 vector - and no EPSS/KEV/POC telemetry exists to gauge real-world exploitation likelihood.

An attacker who holds an ordinary ERPNext operational role logs in and places a malicious template expression (e.g. a Jinja payload) into a user-controlled message field that is later rendered without validation. When the server renders the field in its unrestricted context, the expression executes server-side, letting the attacker query or modify the database, delete documents, send mail from the site, or make the server issue outbound requests. No public exploit code is identified in the provided data, but the SSTI pattern (CWE-1336) is well understood and straightforward to weaponize.