Frappe ERPNext EUVD-2026-98010

Requires a valid authenticated ERPNext account of any (even low-privilege) role - PR:L in the CVSS vector confirms authentication is mandatory, so this is not remotely exploitable by anonymous users. Given the account, no further special configuration or user interaction is needed: the attacker sends requests directly to the affected endpoints that fail to enforce server-side role checks, in default configurations of ERPNext versions before 15.121.3 or 16.x before 16.35.0. The principal limiting factor is the authentication requirement; risk is therefore concentrated in deployments with multiple user roles, untrusted or self-registered users, or exposure to credential compromise.

This is a credible but moderate priority issue rather than an emergency. The CVSS 4.0 base score of 7.1 is driven by network vector (AV:N), low attack complexity (AC:L), no required user interaction (UI:N), and notably a HIGH availability impact (VA:H) combined with LOW integrity impact (VI:L) and no confidentiality impact (VC:N) - meaning the realistic worst case is unauthorized modification or destruction/corruption of data an attacker should not be able to touch. Critically, PR:L confirms the attacker must already hold a valid authenticated (low-privileged) account, which substantially narrows the threat population to insiders, compromised-credential scenarios, or multi-tenant deployments where low-trust users exist. There is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis'; EPSS was not provided and no SSVC decision data was supplied. No signals conflict, but several are simply absent (EPSS, POC, KEV) - treat the absence as missing data, not as evidence of low risk. Net: a real post-authentication broken-access-control flaw worth patching promptly in any ERPNext instance with multiple user roles, but not a drive-by unauthenticated internet threat.

A low-privileged authenticated ERPNext user (for example a limited staff account) discovers that certain application endpoints do not verify role permissions server-side. They send crafted authenticated requests directly to those endpoints to modify or destroy business records - such as financial or inventory data - that their assigned role should not permit. No public proof-of-concept is referenced, and the attack requires only a valid low-privilege session with no user interaction.