Frappe ERPNext CVE-2026-109661

Exploitation requires a valid authenticated ERPNext account with low privileges (PR:L) on an instance running a vulnerable version (ERPNext before 15.116.0, or 16.x before 16.27.0); the attacker then directly queries specific endpoints that omit proper role-based authorization checks to read financial data outside their permitted role. The attack is network-reachable with low complexity and no user interaction or elevated privileges needed, but it is fundamentally limited by the authentication requirement - it cannot be performed by a fully anonymous/unauthenticated outsider, so the realistic threat is a malicious or compromised low-privilege insider/portal user rather than an internet-wide drive-by.

This is a moderate-priority issue rather than a drop-everything emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 7.1 indicate a network-reachable, low-complexity flaw that nonetheless requires an authenticated, low-privileged account (PR:L), which meaningfully narrows the attacker population to users who already have some foothold (employees, customers, or partners with portal/desk access). Impact is confined to confidentiality (VC:H, with VI:N/VA:N) - an information-disclosure problem exposing financial data, not code execution or data tampering. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated score is driven by the high confidentiality impact and low attack complexity, not by demonstrated real-world use. CWE-862 (Missing Authorization) and the description are consistent with the CVSS vector - both point to an authenticated authorization-check failure, so there is no signal conflict to flag. Overall: a credible insider/low-privilege data-exposure risk worth patching on a normal cycle, but absent KEV/EPSS/POC signals it is not a mass-exploitation threat.

A user holding a low-privilege ERPNext account (e.g., a limited employee or portal user) sends authenticated requests directly to the affected endpoints, which fail to enforce role-based authorization. Because the attack is network-based with low complexity and no user interaction, the attacker simply queries the endpoints and receives financial records they should not be permitted to see. No public exploit code is identified at time of analysis, so this would require manual crafting of the endpoint requests.