Frappe ERPNext EUVD-2026-98019

Exploitation requires a valid authenticated ERPNext account with at least low privileges (PR:L); it is not available to fully unauthenticated attackers. The attacker must reach the specific status-modification endpoints that omit role enforcement, so impact is limited to altering record status and business data integrity on affected versions (ERPNext before 15.121.0 and 16.x before 16.34.0). Limiting factors: the required pre-existing authenticated account and the absence of confidentiality or availability impact (VC:N/VA:N) make this mainly an insider or post-account-compromise escalation path rather than a remote unauthenticated compromise.

This is a credible but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with impact confined to integrity (VI:H; VC:N, VA:N) - consistent with CWE-862 Missing Authorization allowing a legitimate low-privileged user to modify record status beyond their role. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 7.1 (High) score is driven by ease of access plus integrity damage, not by confidentiality or availability loss or by any wormable/automatable signal. The main gap between the raw score and real-world risk is the PR:L precondition: an attacker must already hold a valid low-privileged ERPNext account, which makes this primarily an insider or post-compromise authorization-escalation risk rather than a drive-by remote takeover. No conflicting signals were found between the CVSS vector and the description - both point to an authenticated, integrity-only authorization bypass.

A low-privileged but authenticated ERPNext user (e.g., a limited internal account or a self-registered portal user) directly invokes one of the affected status-modification endpoints that fails to enforce role checks. Because authorization is missing, they change the status of records they should not control - for example approving, submitting, or cancelling documents - corrupting business data integrity without needing confidentiality or availability impact. No public exploit code was identified, but the low attack complexity and lack of required user interaction make the request trivial to craft once an account is obtained.