Frappe
Monthly
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Stored cross-site scripting in Frappe ERPNext allows an authenticated user with permission to create or rename records to plant script payloads in record names that are later rendered without proper neutralization on certain dashboards, tools, and portal pages. Versions before 15.103.0 and 16.x before 16.12.0 are affected; the vulnerability scores CVSS 4.0 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) and the independent assessment rates it a credible, above-average-priority issue rather than an emergency, because a valid low-privilege login is mandatory, the payload only fires when a victim - ideally a privileged user - opens the specific affected view, and the attacker cannot control exact timing. Successful exploitation can read or modify data and steal session tokens from other users' browsers; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Installations running 15.103.0+ or 16.12.0+ are not vulnerable.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Stored cross-site scripting in Frappe ERPNext (before 15.113.0 and 16.x before 16.24.0) allows an authenticated low-privilege user to persist malicious script in a profile field that is rendered without escaping into portal pages; the payload executes in the browser of any administrator viewing those pages, enabling administrator account takeover. Exploitation requires a low-privilege account with access to edit the vulnerable profile field - realistic where ERPNext exposes self-service portal/website accounts for customers or suppliers - plus administrator interaction to load the poisoned page, which bounds risk below that of a pre-authentication, zero-interaction XSS. No public exploit code was identified at time of analysis.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Stored cross-site scripting in Frappe ERPNext allows an authenticated low-privilege user to plant a malicious payload in a record field that is rendered into an HTML attribute context without escaping; the payload executes in the browser of any higher-privileged user who opens the affected page, which can lead to account takeover of that privileged session. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0, with patched releases 15.119.0 and 16.31.0 addressing the flaw. Exploitation requires an authenticated low-privilege account and depends on a victim with greater privileges passively opening the page, which is the primary limiting factor; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so this should be treated as a credible, actionable priority rather than an emergency.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).
Stored cross-site scripting in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows unauthenticated visitors to plant crafted HTML/script through a public-facing booking page; the payload is stored without neutralization and executes in the browser session of a privileged user who later views the booking content, enabling account takeover of that user. Exploitation is conditional: the instance must expose the public booking feature to untrusted submitters, and impact only completes when an authenticated, higher-privileged user opens the tainted content (UI:P in the CVSS 4.0 vector), so the attack is not fully automatable to immediate compromise and no public exploit code was identified at time of analysis. The vendor has released fixed versions, and this is a genuine priority for organizations that run the vulnerable booking workflow, not merely a high-score-on-paper issue.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Stored cross-site scripting in Frappe ERPNext allows any authenticated user with permission to create records to plant a crafted record name that is later rendered unescaped in a report view, executing arbitrary script in the browser session of whichever user opens that report. Exploitation is not remote-unauthenticated: it requires valid credentials plus create-record rights (CVSS 4.0 PR:L) and is further gated on a second user subsequently opening the vulnerable report (UI:P), meaning the payload lies dormant until then. Impact spans the confidentiality and integrity of the affected session and can be severe when a high-privileged administrator views the report; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the issue is rated 8.5 and warrants prompt patching.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Stored cross-site scripting in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 allows an authenticated user who can create the affected record type to embed script in a record name, which is then interpolated unescaped into markup by a tool view and executed in the browser session of any user who later opens that tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation is authentication-gated at low privileges and depends on victim interaction, making this a moderate-priority, insider-reachable issue rather than an unauthenticated emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because the payload persists in stored data, a single malicious record name can affect every user who subsequently visits the vulnerable tool view, so scope is limited to session-level script execution in the victim's context rather than direct server compromise.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
Unauthenticated path traversal in the SCORMRenderer.render handler of Frappe Learning Management System (LMS) allows a remote attacker to read files outside the intended public/scorm directory on any instance running a version prior to 2.52.1. Because the renderer builds and opens a server-side path from attacker-influenced input without first verifying that the resolved real path stays inside public/scorm, the attacker can retrieve any file the LMS server process can read; per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the impact is limited to confidentiality - no file write, integrity, or code execution is possible through this flaw. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV entry); the vendor addressed it in version 2.52.1.
Incorrect authorization in Frappe Framework development builds allows any authenticated low-privileged user holding print permission on a document to supply raw Jinja template strings to the render_jinja_template endpoint, bypassing the intended System Manager restriction. The template engine executes these strings server-side, enabling arbitrary SELECT queries across unrelated database tables - critically including extraction of password hashes from the __Auth table. No public exploit has been identified at the time of analysis, but the attack is mechanically straightforward for any user with a valid Frappe account and default print permissions, making credential theft the primary real-world risk.
CSRF vulnerabilities in Frappe Framework's OAuth2 consent flow allow network-accessible attackers to trick authenticated users into unknowingly approving OAuth grants or to reuse authorization state across unintended clients, exposing user data and permitting actions within granted scopes. Three weaknesses combine: the consent approval endpoint accepted GET requests, the consent template lacked CSRF token protection, and active OAuth token lookups were not scoped to the requesting client_id. Versions prior to 15.114.0 and 16.x prior to 16.26.0 are affected; vendor-released patches are available and no public exploit has been identified at time of analysis.
Mass assignment of protected fields in Frappe Framework 16.31.0 and earlier allows authenticated low-privilege users to overwrite standard and child-table fields - including ownership, timestamps, and system metadata - via a type confusion bug in the `frappe.client.set_value` endpoint. When `fieldname` is passed as a JSON dictionary rather than a string, the pre-parse forbidden-field guard evaluates the dict object itself against the protected-field list (where it never matches), then parses the dict into individual assignments that bypass protection entirely. No released patched version is available at time of analysis; only an upstream commit and open PR exist. No public exploit identified at time of analysis.
SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Improper authorization in ERPNext's CRM module allows authenticated low-privileged users to retrieve CRM opportunity data beyond their permitted scope via the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Versions before 15.115.0 and before 16.26.0 are affected, with patches now available from Frappe. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-privilege, network-accessible nature of the flaw makes it a realistic insider threat or credential-abuse vector.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Server-side template injection in Frappe ERPNext (versions before 15.111.0 and 16.22.0) lets an authenticated user holding only a standard operational role inject a malicious template payload into a configuration field, causing the server to render it and disclose data the user is not authorized to see. Because the flaw is rooted in an authorization failure (CWE-863), it effectively bypasses ERPNext's role/permission boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a fixed release is available from the vendor.
Arbitrary file write leading to remote code execution in the Frappe framework (versions prior to 15.112.0 and 16.23.0) allows a privileged user to abuse the Package Import feature, where tarfile members are extracted without adequate path validation (a TarSlip / path-traversal flaw, CWE-22). An attacker who can upload a crafted package tarball can write files outside the intended extraction directory to overwrite application files and achieve code execution as the Frappe service account. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 8.6, reflecting high impact gated by a high-privilege prerequisite.
Broken access control in the Frappe framework (all versions prior to 16.19.0) lets a low-privileged authenticated user modify public Workspaces they should not control, because the update_page endpoint failed to enforce the Workspace Manager edit permission on public workspaces. Any user able to reach the endpoint can alter shared workspace layout and content, an integrity-only impact with no data disclosure. No public exploit has been identified, EPSS/KEV data were not provided, and the fix is shipped in Frappe 16.19.0.
Local file inclusion in the Frappe Framework's Chrome PDF Generator (versions prior to 16.18.3) allows an authenticated user to abuse the 'secure local resource access' mechanism to traverse the filesystem and read arbitrary local files on the server. The flaw is a CWE-22 path traversal disclosed via GitHub Security Advisory GHSA-234v-jfr8-v2f8 and carries a CVSS 4.0 base score of 7.1 (VC:H - confidentiality-only impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector with only low privileges makes it a meaningful information-disclosure risk on multi-tenant deployments.
Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with course-editing privileges to write arbitrary files outside the intended upload directory by uploading a maliciously crafted SCORM ZIP package. The CVSS 4.0 base score of 9.4 reflects high impact across confidentiality, integrity, and availability with scope change to subsequent systems, though exploitation requires low-privileged authentication. No public exploit identified at time of analysis.
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrieve files outside intended directories via path traversal sequences in affected versions prior to 15.105.0 and 16.15.0. The CVSS 4.0 base score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation discloses sensitive server-side files such as configuration secrets, site keys, or credentials used by downstream ERPNext deployments.
SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).
SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.
Privilege escalation in ERPNext versions prior to 16.9.1 allows authenticated low-privileged users to modify data outside their assigned role due to missing authorization checks on certain endpoints. The flaw carries a CVSS 9.9 score with scope change, but EPSS is only 0.04% and CISA SSVC reports no observed exploitation, indicating no public exploit identified at time of analysis. The vendor (Frappe) has released a patched version 16.9.1 alongside GHSA-cg5w-7g26-p3w9.
SQL injection in Frappe's bulk_update function enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially achieving complete database compromise including data exfiltration, modification, and deletion. Affects Frappe versions prior to 16.14.0 and 15.104.0. CVSS 9.3 (Critical) reflects network-accessible attack requiring no authentication or user interaction. No public exploit identified at time of analysis, though the attack surface (bulk update API endpoint) and vulnerability class (SQL injection) are well-understood by attackers.
A blind SQL injection vulnerability exists in ERPNext, a free and open-source Enterprise Resource Planning system, affecting versions prior to 15.100.0 and beta versions 16.0.0-beta.1 through 16.7.x. The vulnerability allows authenticated attackers with low-level privileges to perform time-based and boolean-based blind SQL injection attacks through insufficiently validated parameters on certain endpoints, enabling them to infer and extract sensitive database information. This is tagged as an SQLi vulnerability and has been assigned EUVD-2026-13547 by ENISA, with patches available in versions 15.100.0 and 16.8.0.
SQL injection in Frappe framework before 15.84.0/14.99.0.
Frappe versions prior to 15.98.0 and 14.100.0 contain an improper access control vulnerability that allows authenticated users to grant document permissions they do not possess to other users. An attacker with valid credentials could escalate privileges by sharing documents with elevated permissions, potentially exposing sensitive information or enabling unauthorized modifications. No patch is currently available.
Missing authorization in ERPNext ERP before 15.98.0/16.6.0. Patch available.
Authenticated users of Frappe HRMS (Frappe HR) can read sensitive HR records belonging to other employees because the product's PWA employee-data API endpoints fail to enforce object-level authorization prior to versions 15.58.3 (15.x branch) and 16.4.3 (16.x branch). Rated CVSS 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is a read-only confidentiality breach: no integrity or availability impact, and it requires a valid employee-level session, so anonymous external attackers cannot exploit it. Exploitation only works where the deployment exposes the affected PWA endpoints; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 15.58.3 and 16.4.3.
SQL injection in the 'Salary Payments via ECS' report of Frappe HR (HRMS) lets an authenticated HR/payroll user read sensitive database records by supplying crafted report filter values. The vulnerability affects Frappe HR releases before 15.60.3 on the 15.x line and before 16.7.1 on the 16.x line, and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); because the CVSS vector specifies PR:L, exploitation requires a valid low-privileged account and is therefore an insider or post-compromise vector rather than an anonymous remote attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is resolved by vendor patches 15.60.3 and 16.7.1.
ERPNext instances prior to 15.118.0 (v15 branch) and 16.27.0 (v16 branch) expose financial data through the Sales Person-wise Transaction Summary report because the report's server-side query omits the requesting user's document-permission match conditions. An authenticated attacker holding only a limited role that can run this report can read Sales Order/Sales Invoice, Sales Team, and item-level financial rows for records the role should never see, resulting in a high-confidentiality, read-only disclosure (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; CWE-862 Missing Authorization). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so risk is driven by the low exploitation complexity for any logged-in low-privilege user rather than by observed attacks.
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce its per-user restrict_ip IP allowlist for non-session authentication methods, allowing an authenticated attacker with a valid API key, OAuth token, or header-based credential to authenticate from an IP address outside the configured allowlist. This bypasses network-based access restrictions but requires both a valid non-session credential and a targeted user account that has restrict_ip configured; it is a medium-severity access-control flaw (CVSS 4.0 base 5.3) with limited confidentiality and integrity impact. No public exploit identified at time of analysis.
An open redirect in the Frappe Framework OAuth/social login flow lets a crafted 'state' value control where a user is sent after completing third-party authentication, so a victim who clicks an attacker-supplied login link can be bounced to an attacker-chosen site under the trusted Frappe domain. Only instances that have OAuth social login configured and enabled are affected, and exploitation requires the victim to click the link and finish authenticating at the provider (CVSS 5.1, UI:A, PR:N, S:C, with impact limited to low confidentiality/redirection). No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is modest severity and best handled as routine patch-cycle work, with fixes shipped in Frappe 15.116.0 and 16.29.0.
Broken access control in Frappe Suite's JMAP mail APIs allows authenticated mail users to read other accounts' mailbox metadata by supplying a victim's JMAP account ID. Affected deployments are any Frappe Suite build prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f that runs the Mail service with more than one account; a valid low-privileged mail login (PR:L) is required, and the impact is read-only disclosure of mailbox names, message counts, automation rules containing sender addresses, and storage quota usage rather than message contents. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), keeping this a moderate-severity (CVSS 5.3) information-disclosure issue.
Missing authorization checks in Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 let an authenticated low-privileged user change the status of records they should not be able to touch, bypassing role-based access restrictions. The flaw carries a vendor/VulnCheck CVSS 4.0 base score of 5.3 (moderate) and requires a valid low-privileged session, so exploitation is limited to insiders or holders of legitimately provisioned low-tier accounts; impact is integrity-only, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited (no CISA KEV listing); vendor patches are available in 15.110.0 and 16.21.0, so the practical priority is moderate - patch on a normal maintenance cadence.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users in Frappe ERPNext deployments before 15.112.0 can bypass role-based record permissions by calling specific endpoints that lack proper authorization validation, allowing them to modify individual fields on record types they are not permitted to edit. This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862) with integrity-only impact and no confidentiality or availability loss; no public exploit identified at time of analysis. A vendor security advisory (GHSA-f7x9-qfrf-92m8) and VulnCheck advisory provide further details.
Stored cross-site scripting in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) lets unauthenticated attackers inject crafted markup through a publicly exposed portal form that saves submissions for later back-office review; the payload executes in the browser of the authenticated staff member who opens the stored record. Because the CVSS 4.0 vector carries PR:N, the entry point is unauthenticated, but exploitation is not self-triggering - a human review action is a hard prerequisite (UI:P), and impact is confined to the reviewing user's browser session (SC:L/SI:L) with no direct server-side confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N). Rated 5.3 (medium), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor-released patches exist in ERPNext 15.112.0 and 16.23.0.
Stored cross-site scripting in Frappe ERPNext 16.x before 16.27.0 allows an authenticated user who holds edit (write) rights on a document type to set a record's name field to a script payload that the application later renders without HTML escaping. The script executes in the browser of any colleague who subsequently opens the affected record page, enabling session-context actions such as data theft or UI manipulation within that victim's ERPNext session. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 16.27.0, so this is a genuine but limited medium-severity issue rather than an urgent emergency.
Authenticated low-privileged users can cause ERPNext to send transactional emails for documents they are not permitted to read, due to missing authorization checks in certain endpoints. This affects ERPNext before 15.119.0 and 16.x before 16.31.0. The vulnerability is not known to be actively exploited, no public exploit code has been identified, and the CVSS 3.1 base score is 5.3 (moderate), with limited confidentiality and integrity impact.
Server-side request forgery in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) allows an authenticated user holding a common operational role to point a writable configuration field at an arbitrary destination, causing the ERPNext server to issue outbound requests to hosts that are only reachable from inside the deployment's network. The issue is rated CVSS 5.3 and requires a valid session with permissions to edit the affected field (PR:L), so it is not exploitable by fully unauthenticated attackers; real-world impact depends entirely on what internal services - such as cloud metadata endpoints, internal APIs, or databases - are reachable from the application server. No public exploit code has been identified and the flaw is not confirmed as actively exploited (no CISA KEV listing); per our assessment this is a moderate, not urgent, priority that is fully resolved by upgrading to a fixed release.
Missing authorization checks in certain Frappe ERPNext endpoints allow any authenticated user to read records beyond the scope their assigned role should permit, exposing data that role-based access control is intended to restrict. The flaw affects ERPNext versions before 15.110.0 and 16.x before 16.21.0 and is exploitable only by a logged-in user holding at least a low-privilege account (CVSS PR:L, assessed CVSS 3.1 base 5.3); it is not reachable by unauthenticated attackers, and impact is limited to confidentiality since no integrity or availability effects were identified. Vendor patches are available in 15.110.0 and 16.21.0, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can invoke specific Frappe ERPNext endpoints that fail to enforce authorization checks, allowing them to create records and enumerate availability even when an administrator has disabled the corresponding feature. The flaw affects ERPNext before 15.110.0 and 16.x before 16.21.0, is classified as CWE-862 (missing authorization), and carries a moderate risk profile (6.9 CVSS v4.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) with impact bounded to low-integrity and low-availability effects and no data disclosure, code execution, or privilege escalation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation is nonetheless trivial for any network-reachable instance because no authentication, user interaction, or special conditions are required.
SQL injection in Frappe ERPNext (before 15.121.0 and 16.x before 16.34.0) allows an authenticated user holding high privileges to send specially crafted requests to endpoints that lack input validation, injecting SQL that lets them read sensitive information from the underlying database. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, only confidentiality is affected - data can be read but not modified or destroyed - and the attacker must already hold an elevated/administrative account, which confines realistic risk to insiders or environments where a privileged account has been compromised. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency; vendor patches exist in 15.121.0 and 16.34.0.
Authenticated users of Frappe ERPNext (before 15.121.3 and 16.x before 16.35.0) can abuse a transactional-email endpoint to send arbitrary messages through the site's own configured outgoing mail account, because the endpoint does not verify the caller's authorization before dispatching mail. Any low-privilege account is sufficient - no admin role or special permission is required - and the site must simply have an outgoing email account configured, which is the default for a functioning ERPNext deployment. The result is email relay abuse under the organisation's trusted sending identity, useful for phishing, spam, or reputational damage rather than data theft or service disruption; the assessed impact is limited to low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Stored cross-site scripting in Frappe ERPNext allows an authenticated user with permission to create or rename records to plant script payloads in record names that are later rendered without proper neutralization on certain dashboards, tools, and portal pages. Versions before 15.103.0 and 16.x before 16.12.0 are affected; the vulnerability scores CVSS 4.0 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) and the independent assessment rates it a credible, above-average-priority issue rather than an emergency, because a valid low-privilege login is mandatory, the payload only fires when a victim - ideally a privileged user - opens the specific affected view, and the attacker cannot control exact timing. Successful exploitation can read or modify data and steal session tokens from other users' browsers; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Installations running 15.103.0+ or 16.12.0+ are not vulnerable.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Stored cross-site scripting in Frappe ERPNext (before 15.113.0 and 16.x before 16.24.0) allows an authenticated low-privilege user to persist malicious script in a profile field that is rendered without escaping into portal pages; the payload executes in the browser of any administrator viewing those pages, enabling administrator account takeover. Exploitation requires a low-privilege account with access to edit the vulnerable profile field - realistic where ERPNext exposes self-service portal/website accounts for customers or suppliers - plus administrator interaction to load the poisoned page, which bounds risk below that of a pre-authentication, zero-interaction XSS. No public exploit code was identified at time of analysis.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Stored cross-site scripting in Frappe ERPNext allows an authenticated low-privilege user to plant a malicious payload in a record field that is rendered into an HTML attribute context without escaping; the payload executes in the browser of any higher-privileged user who opens the affected page, which can lead to account takeover of that privileged session. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0, with patched releases 15.119.0 and 16.31.0 addressing the flaw. Exploitation requires an authenticated low-privilege account and depends on a victim with greater privileges passively opening the page, which is the primary limiting factor; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so this should be treated as a credible, actionable priority rather than an emergency.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Authenticated users can modify records in Frappe ERPNext before 16.22.0 by invoking endpoints that omit proper authorization checks, allowing operations beyond their permitted role and resulting in unauthorized data modification. This missing authorization flaw (CWE-862) requires a valid low-privilege account and network access to the ERPNext web application, but no victim interaction; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms integrity impact only. No public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).
Stored cross-site scripting in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows unauthenticated visitors to plant crafted HTML/script through a public-facing booking page; the payload is stored without neutralization and executes in the browser session of a privileged user who later views the booking content, enabling account takeover of that user. Exploitation is conditional: the instance must expose the public booking feature to untrusted submitters, and impact only completes when an authenticated, higher-privileged user opens the tainted content (UI:P in the CVSS 4.0 vector), so the attack is not fully automatable to immediate compromise and no public exploit code was identified at time of analysis. The vendor has released fixed versions, and this is a genuine priority for organizations that run the vulnerable booking workflow, not merely a high-score-on-paper issue.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization enforcement in Frappe ERPNext endpoints lets authenticated low-privileged users read personal data beyond the scope their assigned role permits, affecting releases before 15.120.0 and 16.x before 16.33.0. The flaw is network-reachable and requires only a valid session for a minimal role, as reflected in the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N with confidentiality-only impact (C:H, I:N, A:N) and a CVSS 4.0 base score of 7.1; unauthenticated attackers cannot exploit it. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is a moderate-priority access-control defect rather than a critical remote-code compromise, with the main risk being unauthorized disclosure of employee, customer, or contact records held in the ERP.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Missing authorization checks in Frappe ERPNext before 15.121.3 and in 16.x before 16.35.0 allow any authenticated user - including a low-privilege or self-registered account - to send requests to certain endpoints and modify data beyond what their assigned role permits. Authentication is mandatory (PR:L in the assessed vector), so anonymous remote exploitation is not possible; risk is concentrated in deployments with many distinct user roles, untrusted or self-registered users, or exposure to credential compromise. There is no public exploit identified at time of analysis and no CISA KEV entry, and the vendor has released fixed versions in the 15.x and 16.x lines.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Stored cross-site scripting in Frappe ERPNext allows any authenticated user with permission to create records to plant a crafted record name that is later rendered unescaped in a report view, executing arbitrary script in the browser session of whichever user opens that report. Exploitation is not remote-unauthenticated: it requires valid credentials plus create-record rights (CVSS 4.0 PR:L) and is further gated on a second user subsequently opening the vulnerable report (UI:P), meaning the payload lies dormant until then. Impact spans the confidentiality and integrity of the affected session and can be severe when a high-privileged administrator views the report; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the issue is rated 8.5 and warrants prompt patching.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Stored cross-site scripting in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 allows an authenticated user who can create the affected record type to embed script in a record name, which is then interpolated unescaped into markup by a tool view and executed in the browser session of any user who later opens that tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation is authentication-gated at low privileges and depends on victim interaction, making this a moderate-priority, insider-reachable issue rather than an unauthenticated emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because the payload persists in stored data, a single malicious record name can affect every user who subsequently visits the vulnerable tool view, so scope is limited to session-level script execution in the victim's context rather than direct server compromise.
Arbitrary file read in Frappe Framework versions before 15.117.0 and 16.x before 16.30.0 allows a user who can supply outgoing email HTML content to set an HTML attribute value pointing at a local server file path, which the framework then dereferences and exposes, disclosing server files readable by the Frappe service account. The flaw is remote and low-complexity but requires an authenticated account with enough privilege to author or configure outgoing email/notification content (CVSS vector PR:L, no victim user interaction), so its impact is confined to information disclosure of the service account's readable files rather than code execution or data modification; the vendor advisory GHSA-8v98-cfpm-9p67 and VulnCheck advisory describe the fix, and no public exploit code has been identified at time of analysis.
Unauthenticated path traversal in the SCORMRenderer.render handler of Frappe Learning Management System (LMS) allows a remote attacker to read files outside the intended public/scorm directory on any instance running a version prior to 2.52.1. Because the renderer builds and opens a server-side path from attacker-influenced input without first verifying that the resolved real path stays inside public/scorm, the attacker can retrieve any file the LMS server process can read; per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) the impact is limited to confidentiality - no file write, integrity, or code execution is possible through this flaw. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV entry); the vendor addressed it in version 2.52.1.
Incorrect authorization in Frappe Framework development builds allows any authenticated low-privileged user holding print permission on a document to supply raw Jinja template strings to the render_jinja_template endpoint, bypassing the intended System Manager restriction. The template engine executes these strings server-side, enabling arbitrary SELECT queries across unrelated database tables - critically including extraction of password hashes from the __Auth table. No public exploit has been identified at the time of analysis, but the attack is mechanically straightforward for any user with a valid Frappe account and default print permissions, making credential theft the primary real-world risk.
CSRF vulnerabilities in Frappe Framework's OAuth2 consent flow allow network-accessible attackers to trick authenticated users into unknowingly approving OAuth grants or to reuse authorization state across unintended clients, exposing user data and permitting actions within granted scopes. Three weaknesses combine: the consent approval endpoint accepted GET requests, the consent template lacked CSRF token protection, and active OAuth token lookups were not scoped to the requesting client_id. Versions prior to 15.114.0 and 16.x prior to 16.26.0 are affected; vendor-released patches are available and no public exploit has been identified at time of analysis.
Mass assignment of protected fields in Frappe Framework 16.31.0 and earlier allows authenticated low-privilege users to overwrite standard and child-table fields - including ownership, timestamps, and system metadata - via a type confusion bug in the `frappe.client.set_value` endpoint. When `fieldname` is passed as a JSON dictionary rather than a string, the pre-parse forbidden-field guard evaluates the dict object itself against the protected-field list (where it never matches), then parses the dict into individual assignments that bypass protection entirely. No released patched version is available at time of analysis; only an upstream commit and open PR exist. No public exploit identified at time of analysis.
SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Server-side template injection in ERPNext (Frappe framework) lets low-privileged authenticated users escape the Frappe safe-execution sandbox and achieve remote code execution on the server. The root cause is that frappe.render_template was exposed inside the safe_exec globals without forcing restrict_globals, so a user who can supply template content crosses a permission boundary into unrestricted Jinja evaluation. Rated CVSS 9.9 with a scope change; no public exploit code or CISA KEV listing is identified at time of analysis, but the fix commit is public, narrowing the reversing effort required.
Improper authorization in ERPNext's CRM module allows authenticated low-privileged users to retrieve CRM opportunity data beyond their permitted scope via the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Versions before 15.115.0 and before 16.26.0 are affected, with patches now available from Frappe. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-privilege, network-accessible nature of the flaw makes it a realistic insider threat or credential-abuse vector.
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by supplying an unrelated batch that was never linked to the target course, granting access to premium content without completing payment. The flaw is an authorization/business-logic weakness (CWE-288) fixed in version 2.52.0, which now verifies the batch belongs to the course before enrollment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Server-side template injection in Frappe ERPNext (versions before 15.111.0 and 16.22.0) lets an authenticated user holding only a standard operational role inject a malicious template payload into a configuration field, causing the server to render it and disclose data the user is not authorized to see. Because the flaw is rooted in an authorization failure (CWE-863), it effectively bypasses ERPNext's role/permission boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a fixed release is available from the vendor.
Arbitrary file write leading to remote code execution in the Frappe framework (versions prior to 15.112.0 and 16.23.0) allows a privileged user to abuse the Package Import feature, where tarfile members are extracted without adequate path validation (a TarSlip / path-traversal flaw, CWE-22). An attacker who can upload a crafted package tarball can write files outside the intended extraction directory to overwrite application files and achieve code execution as the Frappe service account. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 base score is 8.6, reflecting high impact gated by a high-privilege prerequisite.
Broken access control in the Frappe framework (all versions prior to 16.19.0) lets a low-privileged authenticated user modify public Workspaces they should not control, because the update_page endpoint failed to enforce the Workspace Manager edit permission on public workspaces. Any user able to reach the endpoint can alter shared workspace layout and content, an integrity-only impact with no data disclosure. No public exploit has been identified, EPSS/KEV data were not provided, and the fix is shipped in Frappe 16.19.0.
Local file inclusion in the Frappe Framework's Chrome PDF Generator (versions prior to 16.18.3) allows an authenticated user to abuse the 'secure local resource access' mechanism to traverse the filesystem and read arbitrary local files on the server. The flaw is a CWE-22 path traversal disclosed via GitHub Security Advisory GHSA-234v-jfr8-v2f8 and carries a CVSS 4.0 base score of 7.1 (VC:H - confidentiality-only impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector with only low privileges makes it a meaningful information-disclosure risk on multi-tenant deployments.
Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with course-editing privileges to write arbitrary files outside the intended upload directory by uploading a maliciously crafted SCORM ZIP package. The CVSS 4.0 base score of 9.4 reflects high impact across confidentiality, integrity, and availability with scope change to subsequent systems, though exploitation requires low-privileged authentication. No public exploit identified at time of analysis.
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrieve files outside intended directories via path traversal sequences in affected versions prior to 15.105.0 and 16.15.0. The CVSS 4.0 base score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, though no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Successful exploitation discloses sensitive server-side files such as configuration secrets, site keys, or credentials used by downstream ERPNext deployments.
SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).
SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.
Privilege escalation in ERPNext versions prior to 16.9.1 allows authenticated low-privileged users to modify data outside their assigned role due to missing authorization checks on certain endpoints. The flaw carries a CVSS 9.9 score with scope change, but EPSS is only 0.04% and CISA SSVC reports no observed exploitation, indicating no public exploit identified at time of analysis. The vendor (Frappe) has released a patched version 16.9.1 alongside GHSA-cg5w-7g26-p3w9.
SQL injection in Frappe's bulk_update function enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially achieving complete database compromise including data exfiltration, modification, and deletion. Affects Frappe versions prior to 16.14.0 and 15.104.0. CVSS 9.3 (Critical) reflects network-accessible attack requiring no authentication or user interaction. No public exploit identified at time of analysis, though the attack surface (bulk update API endpoint) and vulnerability class (SQL injection) are well-understood by attackers.
A blind SQL injection vulnerability exists in ERPNext, a free and open-source Enterprise Resource Planning system, affecting versions prior to 15.100.0 and beta versions 16.0.0-beta.1 through 16.7.x. The vulnerability allows authenticated attackers with low-level privileges to perform time-based and boolean-based blind SQL injection attacks through insufficiently validated parameters on certain endpoints, enabling them to infer and extract sensitive database information. This is tagged as an SQLi vulnerability and has been assigned EUVD-2026-13547 by ENISA, with patches available in versions 15.100.0 and 16.8.0.
SQL injection in Frappe framework before 15.84.0/14.99.0.
Frappe versions prior to 15.98.0 and 14.100.0 contain an improper access control vulnerability that allows authenticated users to grant document permissions they do not possess to other users. An attacker with valid credentials could escalate privileges by sharing documents with elevated permissions, potentially exposing sensitive information or enabling unauthorized modifications. No patch is currently available.
Missing authorization in ERPNext ERP before 15.98.0/16.6.0. Patch available.
Authenticated users of Frappe HRMS (Frappe HR) can read sensitive HR records belonging to other employees because the product's PWA employee-data API endpoints fail to enforce object-level authorization prior to versions 15.58.3 (15.x branch) and 16.4.3 (16.x branch). Rated CVSS 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the flaw is a read-only confidentiality breach: no integrity or availability impact, and it requires a valid employee-level session, so anonymous external attackers cannot exploit it. Exploitation only works where the deployment exposes the affected PWA endpoints; no public exploit code has been identified at time of analysis, and there is no CISA KEV confirmation of active exploitation. Vendor-released patch: 15.58.3 and 16.4.3.
SQL injection in the 'Salary Payments via ECS' report of Frappe HR (HRMS) lets an authenticated HR/payroll user read sensitive database records by supplying crafted report filter values. The vulnerability affects Frappe HR releases before 15.60.3 on the 15.x line and before 16.7.1 on the 16.x line, and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); because the CVSS vector specifies PR:L, exploitation requires a valid low-privileged account and is therefore an insider or post-compromise vector rather than an anonymous remote attack. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is resolved by vendor patches 15.60.3 and 16.7.1.
ERPNext instances prior to 15.118.0 (v15 branch) and 16.27.0 (v16 branch) expose financial data through the Sales Person-wise Transaction Summary report because the report's server-side query omits the requesting user's document-permission match conditions. An authenticated attacker holding only a limited role that can run this report can read Sales Order/Sales Invoice, Sales Team, and item-level financial rows for records the role should never see, resulting in a high-confidentiality, read-only disclosure (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; CWE-862 Missing Authorization). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, so risk is driven by the low exploitation complexity for any logged-in low-privilege user rather than by observed attacks.
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce its per-user restrict_ip IP allowlist for non-session authentication methods, allowing an authenticated attacker with a valid API key, OAuth token, or header-based credential to authenticate from an IP address outside the configured allowlist. This bypasses network-based access restrictions but requires both a valid non-session credential and a targeted user account that has restrict_ip configured; it is a medium-severity access-control flaw (CVSS 4.0 base 5.3) with limited confidentiality and integrity impact. No public exploit identified at time of analysis.
An open redirect in the Frappe Framework OAuth/social login flow lets a crafted 'state' value control where a user is sent after completing third-party authentication, so a victim who clicks an attacker-supplied login link can be bounced to an attacker-chosen site under the trusted Frappe domain. Only instances that have OAuth social login configured and enabled are affected, and exploitation requires the victim to click the link and finish authenticating at the provider (CVSS 5.1, UI:A, PR:N, S:C, with impact limited to low confidentiality/redirection). No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is modest severity and best handled as routine patch-cycle work, with fixes shipped in Frappe 15.116.0 and 16.29.0.
Broken access control in Frappe Suite's JMAP mail APIs allows authenticated mail users to read other accounts' mailbox metadata by supplying a victim's JMAP account ID. Affected deployments are any Frappe Suite build prior to commit 2697564a9c46da6acc614743eaf9915fe5238f4f that runs the Mail service with more than one account; a valid low-privileged mail login (PR:L) is required, and the impact is read-only disclosure of mailbox names, message counts, automation rules containing sender addresses, and storage quota usage rather than message contents. No public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), keeping this a moderate-severity (CVSS 5.3) information-disclosure issue.
Missing authorization checks in Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 let an authenticated low-privileged user change the status of records they should not be able to touch, bypassing role-based access restrictions. The flaw carries a vendor/VulnCheck CVSS 4.0 base score of 5.3 (moderate) and requires a valid low-privileged session, so exploitation is limited to insiders or holders of legitimately provisioned low-tier accounts; impact is integrity-only, with no confidentiality or availability effect. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited (no CISA KEV listing); vendor patches are available in 15.110.0 and 16.21.0, so the practical priority is moderate - patch on a normal maintenance cadence.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users in Frappe ERPNext deployments before 15.112.0 can bypass role-based record permissions by calling specific endpoints that lack proper authorization validation, allowing them to modify individual fields on record types they are not permitted to edit. This is a medium-severity (CVSS 5.3) broken-access-control flaw (CWE-862) with integrity-only impact and no confidentiality or availability loss; no public exploit identified at time of analysis. A vendor security advisory (GHSA-f7x9-qfrf-92m8) and VulnCheck advisory provide further details.
Stored cross-site scripting in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) lets unauthenticated attackers inject crafted markup through a publicly exposed portal form that saves submissions for later back-office review; the payload executes in the browser of the authenticated staff member who opens the stored record. Because the CVSS 4.0 vector carries PR:N, the entry point is unauthenticated, but exploitation is not self-triggering - a human review action is a hard prerequisite (UI:P), and impact is confined to the reviewing user's browser session (SC:L/SI:L) with no direct server-side confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N). Rated 5.3 (medium), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor-released patches exist in ERPNext 15.112.0 and 16.23.0.
Stored cross-site scripting in Frappe ERPNext 16.x before 16.27.0 allows an authenticated user who holds edit (write) rights on a document type to set a record's name field to a script payload that the application later renders without HTML escaping. The script executes in the browser of any colleague who subsequently opens the affected record page, enabling session-context actions such as data theft or UI manipulation within that victim's ERPNext session. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 16.27.0, so this is a genuine but limited medium-severity issue rather than an urgent emergency.
Authenticated low-privileged users can cause ERPNext to send transactional emails for documents they are not permitted to read, due to missing authorization checks in certain endpoints. This affects ERPNext before 15.119.0 and 16.x before 16.31.0. The vulnerability is not known to be actively exploited, no public exploit code has been identified, and the CVSS 3.1 base score is 5.3 (moderate), with limited confidentiality and integrity impact.
Server-side request forgery in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) allows an authenticated user holding a common operational role to point a writable configuration field at an arbitrary destination, causing the ERPNext server to issue outbound requests to hosts that are only reachable from inside the deployment's network. The issue is rated CVSS 5.3 and requires a valid session with permissions to edit the affected field (PR:L), so it is not exploitable by fully unauthenticated attackers; real-world impact depends entirely on what internal services - such as cloud metadata endpoints, internal APIs, or databases - are reachable from the application server. No public exploit code has been identified and the flaw is not confirmed as actively exploited (no CISA KEV listing); per our assessment this is a moderate, not urgent, priority that is fully resolved by upgrading to a fixed release.
Missing authorization checks in certain Frappe ERPNext endpoints allow any authenticated user to read records beyond the scope their assigned role should permit, exposing data that role-based access control is intended to restrict. The flaw affects ERPNext versions before 15.110.0 and 16.x before 16.21.0 and is exploitable only by a logged-in user holding at least a low-privilege account (CVSS PR:L, assessed CVSS 3.1 base 5.3); it is not reachable by unauthenticated attackers, and impact is limited to confidentiality since no integrity or availability effects were identified. Vendor patches are available in 15.110.0 and 16.21.0, and no public exploit identified at time of analysis.
Unauthenticated remote attackers can invoke specific Frappe ERPNext endpoints that fail to enforce authorization checks, allowing them to create records and enumerate availability even when an administrator has disabled the corresponding feature. The flaw affects ERPNext before 15.110.0 and 16.x before 16.21.0, is classified as CWE-862 (missing authorization), and carries a moderate risk profile (6.9 CVSS v4.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) with impact bounded to low-integrity and low-availability effects and no data disclosure, code execution, or privilege escalation. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; exploitation is nonetheless trivial for any network-reachable instance because no authentication, user interaction, or special conditions are required.
SQL injection in Frappe ERPNext (before 15.121.0 and 16.x before 16.34.0) allows an authenticated user holding high privileges to send specially crafted requests to endpoints that lack input validation, injecting SQL that lets them read sensitive information from the underlying database. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, only confidentiality is affected - data can be read but not modified or destroyed - and the attacker must already hold an elevated/administrative account, which confines realistic risk to insiders or environments where a privileged account has been compromised. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, making this a genuine but moderate-priority issue rather than an emergency; vendor patches exist in 15.121.0 and 16.34.0.
Authenticated users of Frappe ERPNext (before 15.121.3 and 16.x before 16.35.0) can abuse a transactional-email endpoint to send arbitrary messages through the site's own configured outgoing mail account, because the endpoint does not verify the caller's authorization before dispatching mail. Any low-privilege account is sufficient - no admin role or special permission is required - and the site must simply have an outgoing email account configured, which is the default for a functioning ERPNext deployment. The result is email relay abuse under the organisation's trusted sending identity, useful for phishing, spam, or reputational damage rather than data theft or service disruption; the assessed impact is limited to low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.