Frappe ERPNext EUVD-2026-98056

Requires a valid authenticated ERPNext account with low privileges (PR:L) and network access to the application; the attacker directly invokes specific endpoints that fail to enforce role-based permission checks, allowing deactivation of master records outside their assigned role. Exploitation is limited by the need for working credentials on the target instance - it is not reachable by fully unauthenticated attackers - and is scoped to integrity of master data (deactivation), with no path to data disclosure or service outage. Affects default configurations of ERPNext versions before 15.108.0 and 16.x before 16.18.0; patched instances are not exposed.

This is a moderate-severity authorization flaw (CWE-862), not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but it requires an already-authenticated low-privileged account (PR:L), which meaningfully narrows the attacker population to insiders or anyone who has obtained valid low-tier credentials. Impact is constrained: only VI:L (low integrity) is set, with VC:N and VA:N, reflecting that the attacker can deactivate master records but cannot read sensitive data or cause outages - consistent with the 5.3 Medium base score. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no signal of active or widespread exploitation; this reads as a real-but-contained privilege/integrity issue rather than an urgent emergency. One data caveat: the input Tags label this 'Authentication Bypass,' which conflicts with the description and CWE-862 - this is a missing-authorization (privilege) flaw affecting already-authenticated users, not an authentication bypass; verify against the Frappe GHSA advisory before categorizing.

A disgruntled employee or an attacker who has phished a standard low-privileged ERPNext user account logs in and invokes the affected endpoints directly, bypassing the role-based permission checks that the UI would normally enforce. Using this access they deactivate master records (such as customers, suppliers, or item masters) they are not authorized to modify, disrupting business operations. No public exploit identified at time of analysis, and low attack complexity means scripting the endpoint calls would be straightforward for someone with a valid session.