Frappe ERPNext CVE-2026-109667

Exploitation requires an authenticated session on the target ERPNext site, but critically the account needs no operational role - any logged-in user suffices (PR:L). The concrete prerequisite is access to the affected record-creation endpoint, which derives the record doctype from the request and performs the insert with permission checks disabled; the attacker simply supplies a privileged record type (e.g., a User or role-assignment document). No user interaction, no non-default configuration, and no special feature toggle are described as required - the flawed behavior is present in default affected versions. The principal limiting factors are therefore the need for a valid login (which is low where self-registration or many internal users exist) and that the deployment must run an affected version (before 15.111.0, or 16.x before 16.22.0).

This is a genuine high-priority issue, not an inflated high-CVSS score. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with HIGH impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with the description's claim of full site takeover via creation of privileged accounts. The PR:L requirement is the main mitigating signal, but the description weakens even that: 'any authenticated user, including one holding no operational role' can exploit it, so the effective privilege bar is merely a valid login, which is low for multi-tenant or self-registration-enabled ERPNext deployments. No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis; this absence should not be read as low risk given the trivial exploit mechanics. Signals are mutually consistent (no conflicts between CVSS and description). The CVSS 4.0 vector is vendor/VulnCheck-supplied rather than independently reproduced; CVSS 3.1 metrics and SSVC/automatable data were not provided.

An attacker with any low-privilege authenticated ERPNext account (or one obtained via open registration) sends a crafted request to the record-creation endpoint, specifying a privileged record type (such as a User/role-granting document) that the endpoint inserts with permission checks disabled. This creates a new administrative account, giving the attacker full control of the site. No public POC was provided in the input, but the described mechanism requires no special tooling.