CVE-2026-109665— Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Quick assessment
Affected
frappe erpnext
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Frappe ERPNext 15.108.0 版本之前以及 16.x 版本中 16.18.0 版本之前，存在一个未授权访问漏洞。该漏洞发生在某些未正确执行权限检查的端点上。低权限的已认证用户可利用这些端点停用主记录（master records），从而执行超出其角色权限范围的数据修改操作。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109665
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109665
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109665
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109665 (2)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2026-109667 | 8.8 HIGH | Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation |
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109614 | 6.5 MEDIUM | Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109627 | 6.5 MEDIUM | Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109615 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints |
| CVE-2026-109661 | 6.5 MEDIUM | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109672 | 6.5 MEDIUM | Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: erpnext
-
CVE-2026-108373
ERPNext: Unauthorised access to financial data due to missin -
CVE-2026-108374
ERPNext: Unauthorised status modification due to missing val -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record
Same vendor: frappe
-
CVE-2026-114664
Frappe before 16.33.0 Blind SQL Injection via get_events -
CVE-2026-111938
Frappe CRM before 1.74.0 Missing Authorization via add_note_ -
CVE-2026-111939
Frappe Helpdesk before 1.26.0 Authorization Bypass via raise -
CVE-2026-111937
Frappe CRM before 1.81.2 Missing Authorization on CRM Notifi -
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enable
Same weakness: CWE-862
-
CVE-2026-25716
BlueSpiceUserManager: Missing authorization in REST endpoint -
CVE-2026-112359
WordPress WPMobile.App plugin <= 11.86 - Broken Access Contr -
CVE-2026-112825
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access -
CVE-2026-112821
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control -
CVE-2026-115373
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5
V. Comments for CVE-2026-109665
No comments yet