Frappe ERPNext EUVD-2026-98034

Requires a valid authenticated ERPNext account with at least low-privilege access to the application (PR:L) - not exploitable by fully unauthenticated remote attackers. Exploitation targets specific project-related endpoints that fail to enforce permission checks, so the attacker must reach those endpoints directly (knowledge of the endpoint/API call). Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0; patched versions enforce the checks. The main limiting factor is the authentication requirement and the read-only nature of the impact (project data disclosure only - no data modification or service disruption). Risk is highest in multi-user or multi-tenant installations where low-privileged or semi-trusted accounts exist.

This is a moderate-severity, confidentiality-only broken-access-control flaw (CWE-862). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: exploitation is network-reachable and low-complexity, but explicitly requires an authenticated low-privileged account (PR:L), and impact is limited to reading project data (VC:H, with VI/VA:N - no write or availability impact). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - this is 'no public exploit identified at time of analysis.' The signals are not conflicting but they are incomplete: the high-ish CVSS is driven by easy triggering once authenticated, yet the PR:L prerequisite and read-only scope substantially lower real-world urgency compared to an unauthenticated RCE. Net assessment: a legitimate priority for multi-tenant or large-user ERPNext deployments where low-privileged accounts are numerous or untrusted, but closer to a 'patch in normal cycle' issue for single-tenant installs with a small, trusted user base. Absence of EPSS/KEV/POC is a data gap, not a safety guarantee.

A low-privileged authenticated ERPNext user (for example an employee with limited project access, or an attacker who has obtained any valid low-tier credential) directly invokes the vulnerable project-related endpoints that skip permission enforcement. Because the server fails to check the caller's role, the endpoint returns project records the user was never granted access to, enabling horizontal/vertical information disclosure of sensitive project data. No public exploit code was identified, but the attack is low-complexity and requires no special tooling beyond an authenticated session and knowledge of the endpoint.