Frappe ERPNext CVE-2026-109659

Exploitation requires a valid authenticated ERPNext session of any privilege level (PR:L) - exploitation is NOT possible without credentials. The attacker must reach the specific unprotected endpoints that fail to enforce permission checks; the description does not name a non-default feature or configuration setting, implying the flaw is present in standard deployments of the affected versions. The key limiting factor is the authentication requirement: the attacker needs at least a low-privilege account (e.g., an employee or portal user), so the realistic threat is a malicious or compromised insider/low-tier user rather than an anonymous internet attacker. Impact is limited to reading financial data (confidentiality); no data modification or service disruption results.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) and score of 7.1 describe a network-exploitable, low-complexity flaw that requires authenticated access (PR:L) and yields high confidentiality impact with no integrity or availability impact - consistent with the CWE-862 missing-authorization description allowing authenticated users to read financial data beyond their role. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent mass exploitation; the exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a confidentiality-only, authenticated information-disclosure bug reported by VulnCheck, which is a credible research source but not a confirmation of in-the-wild use. The main risk driver is that any legitimate low-privilege user (e.g., an ordinary ERPNext employee account) can escalate their data visibility to financial records - an insider/least-privilege-violation risk rather than a remote-unauthenticated takeover. Note the 'Authentication Bypass' tag somewhat overstates the issue: this is authorization bypass (horizontal/vertical privilege escalation on data reads), not authentication bypass, since valid credentials are required.

A low-privilege but authenticated ERPNext user (such as a standard employee or a self-registered portal/customer account) directly calls the affected API endpoints that omit permission enforcement. Because the endpoints fail to check the caller's role, the user retrieves financial data - such as accounting, invoicing, or payment records - that their assigned role should not expose. No public exploit code is known, but exploitation is trivial for anyone with a valid account since it only requires issuing authenticated requests to the vulnerable endpoints.