Frappe ERPNext CVE-2026-109669

Exploitation requires a valid authenticated session as a low-privileged ERPNext user (PR:L) and the ability to reach the specific record-status-change endpoints that omit role-based authorization checks; no user interaction is needed (UI:N). The flaw is network-reachable (AV:N) against affected versions (ERPNext < 15.110.0 and 16.x < 16.21.0) in their standard configuration, so no special non-default feature toggle is indicated by the description. The principal limiting factor is the authentication requirement: an attacker must already possess or obtain low-tier credentials, which restricts this to insiders or accounts reachable via a provisioned/self-registered low-privilege role. Impact is limited to integrity of records the user should not be able to modify - no confidentiality or availability impact (VC:N/VA:N).

This is a medium-severity authorization flaw (CVSS 4.0 base 5.3, vendor/VulnCheck-provided) whose real-world priority is moderate, not urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires an already-authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to insiders or anyone who has obtained valid low-tier credentials. Impact is constrained to integrity only (VC:N/VI:L/VA:N) - there is no confidentiality or availability loss and no scope change (SC/SI/SA:N) - so this is a data-tampering/privilege-boundary issue rather than a system-takeover bug. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-management item (especially for multi-tenant or many-user ERPNext deployments where low-privileged accounts are common), but it does not rise to emergency status given authentication is required and impact is limited to low integrity. One data note: CWE-862 (Missing Authorization) and the description both point to an authorization/role-enforcement failure, yet the input tag labels this 'Authentication Bypass' - the flaw is authorization bypass, not authentication bypass; treat the tag loosely.

A low-privileged ERPNext user (e.g., a basic employee or limited portal account) authenticates normally, then calls a record-status-change endpoint that fails to re-check role permissions. Because the endpoint does not enforce authorization, the user modifies the status of records (e.g., approving, submitting, or changing documents) that their assigned role should not permit, altering business data beyond their privilege level. No public exploit code was provided, and exploitation is low-complexity (AC:L) but requires valid low-tier credentials (PR:L).