Frappe ERPNext EUVD-2026-98041

Exploitation requires a valid authenticated low-privileged ERPNext account (PR:L) - it is NOT remote-unauthenticated. The attacker must reach the specific affected endpoints that omit role-based authorization checks and request personal data outside their assigned role's permissions; no user interaction, special client, or non-default configuration is indicated. Affected deployments are ERPNext before 15.112.0 and the 16.x branch before 16.23.0. The principal limiting factor is the credential prerequisite, so realistic risk is highest where low-trust accounts exist in volume (customer/vendor portals, large employee bases, or multi-tenant hosting); single-admin or tightly-controlled internal instances face lower practical exposure.

This is a genuine but moderate-priority access-control flaw (CWE-862, Missing Authorization) rather than a critical perimeter breach. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 (High) and tells a consistent story: network-reachable, low complexity, no user interaction, but requiring PR:L - an already-authenticated, low-privileged account. Impact is confidentiality-only (VC:H, with VI:N/VA:N), matching the description of unauthorized reading of personal data; there is no integrity or availability impact and no scope change to subsequent systems. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so automatability and in-the-wild exploitation cannot be assessed from the input. The exploitation status is therefore: no public exploit identified at time of analysis. The key tempering factor is the authentication prerequisite - an attacker must first hold a valid low-privileged ERPNext account, which makes this most relevant as an insider/post-compromise privilege-boundary violation or in multi-tenant/customer-portal deployments, not as a mass-exploited internet threat. Net: patch on a normal-to-prompt cadence, prioritizing instances exposed to untrusted or large user populations; this is a real data-exposure bug but not a drop-everything emergency absent evidence of active exploitation.

A low-privileged ERPNext user (e.g., a limited employee, portal customer, or self-registered account) sends crafted requests directly to the affected endpoints, which fail to re-check role-based authorization. Because the server returns personal data the user's role should not permit, the attacker reads other users' or records' personal information without triggering any additional controls. No public exploit code is identified, but the attack requires only valid low-privilege credentials and simple HTTP requests (AV:N/AC:L/UI:N).