Frappe ERPNext EUVD-2026-98055

The attacker must be an authenticated ERPNext user holding a common operational role (per CVSS PR:L); given that role, they can call specific endpoints that lack proper authorization validation to change a field on record types outside their role's permissions. Exploitation is bounded by these limiting factors: a valid authenticated account with the operational role is mandatory (no anonymous access), impact is integrity-only and limited to field-level data modification (no confidentiality or availability loss), and the affected instance must be running a version before 15.112.0. The exact endpoints and record types are not specified in the available data.

This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862, missing authorization) in Frappe ERPNext, reported by VulnCheck with a vendor security advisory (GHSA-f7x9-qfrf-92m8). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) signals a network-reachable, low-complexity attack requiring low privileges and no user interaction, with impact limited to partial integrity (VI:L) and no confidentiality or availability loss - consistent with the description of an authenticated operational user tampering with a single field on records outside their role. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (no conflicts between the vector and the description), but the realistic risk is moderate and primarily insider/privilege-escalation in nature: the attacker must already hold a valid, common operational role, and the damage is bounded to unauthorized data modification rather than full compromise. This is a genuine data-integrity and least-privilege concern for multi-tenant or role-segmented ERPNext deployments, but it is not an unauthenticated remote-code-execution class emergency.

An employee or contractor who has been granted a routine operational ERPNext role (the kind issued broadly across a business) discovers that certain endpoints fail to validate authorization. Using their legitimate authenticated session over the network, they invoke those endpoints to alter a field on record types their role should not control - for example tampering with financial, inventory, or approval-related data. No public exploit code is referenced in the available data, so exploitation would currently require manual crafting of the endpoint calls.