CVE-2026-109640— Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
Quick assessment
Affected
frappe erpnext
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Frappe ERPNext 16.22.0 版本之前存在一个授权缺失漏洞，该漏洞允许已认证用户通过调用缺乏适当授权检查的端点来修改记录。攻击者可以调用这些端点，对其角色权限之外的记录执行操作，从而导致数据被未经授权的修改。
Possible ATT&CK Techniques 1 AI
T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109640
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109640
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109640
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109640 (1)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109615 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints |
| CVE-2026-109656 | 6.5 MEDIUM | Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access |
| CVE-2026-109661 | 6.5 MEDIUM | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109614 | 6.5 MEDIUM | Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109627 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109636 | 6.5 MEDIUM | Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: erpnext
-
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin -
CVE-2026-108374
ERPNext: Unauthorised status modification due to missing val -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record
Same vendor: frappe
-
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable -
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Rep -
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin -
CVE-2026-108374
ERPNext: Unauthorised status modification due to missing val -
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing
Same weakness: CWE-862
-
CVE-2026-107744
LearnPress <= 4.4.10 - Missing Authorization to Authenticate -
CVE-2026-109369
WP Booking System <= 2.1.0.3 - Missing Authorization to Auth -
CVE-2026-108123
WP Booking System <= 2.1.0.3 - Missing Authorization to Unau -
CVE-2026-109368
WP Booking System <= 2.1.0.3 - Missing Authorization to Auth -
CVE-2026-107763
Fastcache by Host.it <= 1.7.5 - Missing Authorization to Aut
V. Comments for CVE-2026-109640
No comments yet