Frappe ERPNext EUVD-2026-98012

Exploitation requires an authenticated ERPNext session (PR:L) - any valid low-privilege user account on a vulnerable instance (before 15.120.0 or 16.x before 16.23.0). The specific prerequisite is that the attacker invokes the affected endpoint while setting the caller-supplied flag that disables the endpoint's own permission enforcement; the server trusting that client-supplied flag is the root cause. Limiting factors: the attacker must already hold valid credentials (no unauthenticated access), the impact is scoped to reading party records only (no write/modify, no availability loss), and exploitation is most impactful on multi-user or multi-tenant deployments where role separation actually matters. No user interaction by a victim is required.

This is a legitimate but moderate-priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 (High) and describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with CWE-862 (Missing Authorization) and the description of an authenticated user reading party records beyond their role. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so exploitation signals point to: no public exploit identified at time of analysis. The absence of KEV/EPSS data means real-world exploitation prevalence cannot be quantified from the input; risk is driven by the low barrier to entry for any authenticated tenant user rather than by observed attacks. One signal to verify: the vendor rates confidentiality as high (VC:H), but the scope is limited to 'party records' (customers/suppliers/parties) rather than full database compromise - treat the C:H rating as an upper bound that may overstate impact depending on what PII those records hold. Net: a credible insider/low-privilege escalation-of-access risk worth patching promptly, but not a widespread remote-unauthenticated crisis.

A low-privileged but authenticated ERPNext user (e.g., a limited role account or a user in a multi-tenant/shared instance) calls the affected endpoint and sets the caller-supplied flag that disables the endpoint's own permission enforcement. The server honours the flag, skips role-based permission checks, and returns party records the user's role should not be able to see. No public exploit code was identified in the provided data, but the technique is trivial once the endpoint and flag are known.