ERPNext CVE-2026-109660

Requires a valid authenticated ERPNext account with low privileges (PR:L) on an instance running a vulnerable version (before 15.112.0, or 16.x before 16.23.0); the attacker must reach the specific endpoints that modify production records but omit authorization enforcement. Exploitation is limited by the need for authenticated access (no anonymous/unauthenticated path), and impact is confined to integrity of production/manufacturing data only - there is no confidentiality or availability effect per the vector. No special non-default configuration is indicated, but the attacker must know or discover the affected endpoints.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and the 7.1 score are internally consistent with the description: a network-reachable, low-complexity flaw that requires an authenticated low-privileged account (PR:L) and yields high integrity impact (VI:H) with no confidentiality (VC:N) or availability (VA:N) consequences. The CWE-862 (Missing Authorization) classification aligns cleanly with the described failure to enforce authorization on production-record endpoints. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced in the input, so this is 'no public exploit identified at time of analysis.' The main signals conflict only mildly: the vector says network/low-complexity (easy to reach once authenticated), but the PR:L requirement and the fact that impact is confined to integrity of production data meaningfully bound the real-world blast radius. The input Tag 'Authentication Bypass' conflicts with both CWE-862 and the PR:L requirement - this is an authorization/access-control flaw for already-authenticated users, not an authentication bypass; treat that tag as inaccurate.

A legitimate low-privileged ERPNext user - such as a limited operations or data-entry account - directly calls the production-record endpoints that omit role checks. By crafting requests to these endpoints, the user modifies manufacturing/production data (e.g., work orders, production entries, or BOM-related records) that their assigned role should not permit, corrupting production integrity. No public exploit code is referenced, so exploitation would require an attacker to identify the specific unprotected endpoints.