Frappe ERPNext CVE-2026-109658

Exploitation requires a valid authenticated ERPNext account of any role (PR:L); the flaw is that certain endpoints perform no role-based authorization check, so a logged-in low-privilege user can call them to read data and personal information outside their permitted scope. No user interaction, no special non-default configuration, and no elevated privileges are needed, and the affected endpoints are reachable over the network. The primary limiting factors are (1) the attacker must already possess or obtain authenticated access to the instance, and (2) affected deployments must run ERPNext before 15.115.0 or 16.x before 16.26.0; the specific vulnerable endpoints are not named in the available data.

This is a genuine but moderate-priority issue, best treated as an authenticated data-confidentiality exposure rather than a critical remote-takeover flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, requiring an authenticated low-privilege account (PR:L), with high confidentiality impact but zero integrity and availability impact - matching a missing-authorization (CWE-862) read-only data leak. The 7.1 score is driven almost entirely by the VC:H confidentiality rating, not by any code-execution or integrity risk. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is currently theoretical-but-credible given the low complexity. The main caveat: the vendor advisory (GHSA) and VulnCheck confirm the class of flaw, but the specific vulnerable endpoints are not enumerated in the supplied data, so blast radius per instance cannot be precisely scoped. Note also that the input tag 'Authentication Bypass' conflicts with CWE-862 and the description - this is missing authorization against already-authenticated users, not an authentication bypass.

An attacker holding any valid low-privilege ERPNext account (e.g., a limited employee, customer-portal, or supplier login) directly invokes one of the affected endpoints that omits role-based authorization checks. Because the endpoint returns data without verifying the caller's assigned role, the attacker reads records and personal data belonging to other users or beyond their permission scope. No public exploit code was identified, and exploitation requires an authenticated session but no user interaction or elevated privileges.