Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| frappe | erpnext | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 12 Oct 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control. | |
| Title | Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification | |
| First Time appeared |
Frappe
Frappe erpnext |
|
| Weaknesses | CWE-862 | |
| CPEs | cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Frappe
Frappe erpnext |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-12T22:22:31.573Z
Reserved: 2026-10-12T21:07:34.160Z
Link: CVE-2026-109664
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.