Frappe ERPNext EUVD-2026-98032

No special conditions beyond network reachability - remote unauthenticated exploitation (PR:N/UI:N/AC:L) against affected ERPNext endpoints, which notably remain exploitable even when an administrator has DISABLED the corresponding feature, since the endpoints never enforce the authorization check. Limiting factors: the instance must be network-reachable by the attacker (internet-exposed instances are most at risk), and the achievable impact is bounded to creating records and enumerating availability (VI:L/VA:L) - it does not yield data disclosure (VC:N), code execution, or privilege escalation.

This is a moderate-severity missing-authorization flaw (CWE-862) in Frappe ERPNext. The only supplied severity signal is a CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N and impacts VC:N/VI:L/VA:L - meaning network-reachable, low-complexity, unauthenticated exploitation with NO confidentiality impact and only LOW integrity and availability impact. The attack surface is genuinely easy to reach (no auth, no user interaction, low complexity), which raises its practical attractiveness, but the capped technical impact (creating records and enumerating availability, not data theft or full compromise) keeps overall risk moderate rather than critical. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no evidence of active or probable exploitation - the exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent (an unauthenticated network flaw with limited impact), so no conflict to flag; however, EPSS and SSVC/automatable data are MISSING, so exploitation likelihood cannot be quantified. Net: a real but lower-priority issue - patch on a normal cycle, prioritizing internet-exposed ERPNext instances, rather than emergency response.

An attacker who can reach an ERPNext instance over the network sends unauthenticated HTTP requests directly to the affected endpoints, bypassing the missing authorization checks to create unwanted records (e.g., bookings/leads) and to enumerate availability data even on features an administrator has deliberately disabled. Because PR:N/UI:N/AC:L, no credentials, no victim interaction, and no special tooling are needed. No public exploit code was identified in the provided data.