Frappe ERPNext EUVD-2026-98015

Exploitation requires an authenticated low-privileged ERPNext account (PR:L) and network access to the application's affected API endpoints; it is not exploitable by anonymous/unauthenticated attackers. The flaw affects specific endpoints that omit proper permission enforcement, so a valid session token for even a minimal role is the core prerequisite. Limiting factors: the requirement for valid credentials and the confidentiality-only impact (read access to personal data, no modification or service disruption). The description does not name the exact endpoints or require any non-default configuration, implying default installations of affected versions are exposed.

This is a genuine but moderate-priority access-control flaw (CWE-862, Missing Authorization) rather than a critical remote-code issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: network-reachable, low attack complexity, and requiring an authenticated low-privileged account (PR:L), with impact limited to confidentiality (VC:H) and no integrity or availability impact. The headline 7.1 score is driven almost entirely by the high confidentiality impact on exposed personal data, not by ease of mass exploitation. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was supplied - so there is no signal of active or widespread exploitation; the signals are not conflicting, they are simply absent, which points to a disclosed-but-not-yet-weaponized posture. The key limiting factor is that an attacker must already hold a valid authenticated account on the ERPNext instance, which lowers real-world risk relative to an unauthenticated flaw. One caveat: the 'Authentication Bypass' tag overstates the issue - this is broken authorization for already-authenticated users, not an authentication bypass; treat it as a horizontal/vertical privilege and data-exposure issue.

A low-privileged but legitimate ERPNext user (e.g., a standard employee or self-service portal account) directly calls specific API endpoints that fail to enforce role-based permission checks, retrieving personal data belonging to other users or records outside their authorized scope. Because the attack is over the network with low complexity and no user interaction, a single authenticated account is sufficient to harvest data at scale. No public exploit code was identified at the time of analysis, so exploitation would require independently discovering the vulnerable endpoints.