Frappe ERPNext CVE-2026-109656

Exploitation requires a valid, authenticated ERPNext account with at least low-privilege access (PR:L); it is not reachable by fully unauthenticated attackers. Once authenticated, the attacker invokes the specific item master endpoints that omit server-side role/permission enforcement, letting them read item master data beyond their assigned role. Limiting factors: the attacker must already hold credentials, the affected instance must run a vulnerable version (ERPNext < 15.118.2 or 16.x < 16.30.0), and impact is confined to reading item master data (no write/modify, no availability loss). Risk rises in multi-tenant or internet-exposed deployments with many low-trust user accounts.

This is a moderate-severity information-disclosure flaw, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to users who already have valid ERPNext credentials. Impact is confidentiality-only (VC:H, VI:N/VA:N) - the attacker reads item master data they should not see, with no integrity or availability loss, consistent with the CWE-862 missing-authorization root cause. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are internally consistent (authenticated, confidentiality-only) rather than conflicting. Net: a real but bounded priority best handled on a normal patch cycle, with higher urgency only for multi-tenant or externally-accessible ERPNext deployments where low-privileged accounts are numerous or semi-trusted. Note the input Tags label this 'Authentication Bypass,' whereas the description and CWE-862 describe an authorization (access-control) bypass by an already-authenticated user - verify tagging before using it for triage.

A low-privileged ERPNext user (for example a sales or purchasing clerk) authenticates normally, then directly calls the item master endpoints that fail to enforce role-based authorization. Because the server does not re-check permissions, the user retrieves item master records - pricing, supplier, or catalog data - outside their assigned role scope. No public exploit code was provided, and exploitation requires valid credentials but no special skill given the low attack complexity.