Frappe ERPNext EUVD-2026-98008

Requires an authenticated ERPNext account with at least low-level privileges (PR:L) on an instance running a version before 16.34.0; the attacker then queries financial-data endpoints (accounting/ledger/invoice records) that lack server-side role-permission enforcement. No special non-default configuration or user interaction is needed, and no elevated admin role is required - any valid but under-privileged user who can reach the application over the network can exploit it. Exploitation is LIMITED by the prerequisite of holding valid credentials, which excludes fully unauthenticated external attackers and scopes risk toward insiders or attackers with stolen/registered low-trust accounts.

This is a credible, moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 describes a network-reachable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, with high confidentiality impact but zero integrity or availability impact - consistent with CWE-862 Missing Authorization enabling read-only data exposure. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The key limiting factor is the PR:L requirement: an attacker must first hold a valid, if low-privileged, ERPNext account, which constrains this to insiders or attackers who have already obtained credentials, lowering mass-exploitation likelihood. The real risk is therefore elevated for multi-tenant or large-user-base ERPNext deployments where low-trust accounts are common, and lower for tightly controlled installations. Note the input Tags label this 'Authentication Bypass,' but the description and CWE-862 indicate a broken authorization (access-control) flaw by already-authenticated users, not an authentication bypass - this distinction matters for accurate triage.

A low-privileged but authenticated ERPNext user (e.g., a limited staff or sales role) directly queries financial API endpoints that fail to enforce role-based permission checks, retrieving accounting records, invoices, or ledger data outside their authorized scope. Because the attack is network-based with low complexity and no user interaction required, this can be scripted against the exposed endpoints once a valid session exists. No public proof-of-concept was identified in the provided data.