Frappe ERPNext EUVD-2026-98007

Requires a valid authenticated account on the ERPNext instance (CVSS PR:L), but only low-privilege role membership - no administrative access is needed. Exploitation targets specific document-status modification endpoints that omit authorization checks, so the attacker must be able to reach these endpoints over the network and know/guess the relevant document and status operations. Limiting factors: the attacker must already possess credentials (no unauthenticated anonymous path), impact is bounded to integrity of document status (confidentiality is unaffected), and only versions below 15.121.0 and 16.x below 16.34.0 are affected, so patched or upgraded instances are not exploitable.

This is a genuine but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1 (High) and shows the flaw is network-reachable, low-complexity, and requires only low-privileged authentication with no user interaction - meaning any legitimate low-tier account can trigger it. Impact is concentrated on integrity (VI:H) with minor availability effect (VA:L) and no confidentiality loss (VC:N), consistent with CWE-862 missing authorization enabling unauthorized document status modification. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is driven by ease of abuse by insiders or compromised low-privilege accounts, not by mass internet-facing weaponization. The signals are internally consistent - the authenticated (PR:L) requirement aligns with the description's 'authenticated low-privileged users,' so there is no network-vs-local or auth conflict to flag. The main caveat is the absence of exploitation-probability data (no EPSS) and the single-reporter sourcing (VulnCheck), which limits visibility into real-world attempts.

A low-privileged but authenticated ERPNext user (for example, a junior staff account) sends crafted requests directly to the affected document-status endpoints, which fail to enforce role-based authorization. Because the attack is network-based, low-complexity, and needs no user interaction, the attacker alters document statuses (e.g., submitting, approving, or cancelling records) beyond their assigned role, corrupting business workflow integrity. No public exploit code is identified at time of analysis, so exploitation would currently require an attacker to independently craft the endpoint calls.