Frappe ERPNext EUVD-2026-98036

Requires a valid authenticated ERPNext account with at least low-privilege access (CVSS PR:L) - exploitation is not possible for fully unauthenticated outsiders. The attacker must reach the specific endpoints that omit role-based permission enforcement; affected versions are ERPNext before 15.119.0 and 16.x before 16.31.0, so patched instances are not exploitable. No user interaction, special client, or non-default configuration is required beyond holding a login, which is the primary limiting factor narrowing realistic risk to insiders or anyone able to obtain standard user credentials.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 4.0 base score of 7.1 (HIGH) is driven entirely by integrity impact (VI:H) via network vector, low attack complexity, no user interaction, and - critically - low-privilege authentication required (PR:L), meaning an attacker must already hold a valid, low-privilege ERPNext account. Confidentiality and availability impacts are rated none (VC:N/VA:N), so this is a pure broken-access-control / privilege-escalation flaw that lets an authenticated user create records and modify data beyond their assigned role. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV; no public proof-of-concept is referenced. Exploitation status: no public exploit identified at time of analysis. The combination of 'authenticated, no POC, not in KEV' tempers the raw HIGH severity - the PR:L requirement meaningfully limits the attacker population to insiders or anyone who can obtain a standard user login. There are no conflicting signals here (vector consistently implies authenticated network access matching the 'authenticated attackers' language in the description), but the absence of EPSS means widespread-exploitation likelihood cannot be quantified from the data provided.

An attacker who holds a valid low-privilege ERPNext account (e.g., a limited staff or portal user) sends crafted requests directly to the vulnerable endpoints that skip permission enforcement. Because these endpoints fail CWE-862 authorization checks, the attacker creates or modifies business records - such as financial, HR, or inventory documents - that their assigned role should never be able to touch. No public exploit code is referenced, but the attack requires only standard authenticated API access and low complexity.