CVE-2026-109667— Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Quick assessment
Affected
frappe erpnext
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe ERPNext 在版本 15.111.0 之前以及 16.x 版本在 16.22.0 之前存在一个权限提升漏洞。该漏洞存在于一个用于创建记录的端点中，该端点从请求中获取记录类型，并在禁用权限检查的情况下插入该记录。任何经过身份验证的用户，包括没有任何操作角色的用户，都可以提供特权记录类型，从而创建特权账户并完全控制整个站点。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1078.004 · Cloud Accounts T1136.003 · Cloud Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109667
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109667 (1)
Same Patch Batch · frappe · 2026-10-12 · 86 CVEs total
| CVE-2024-58390 | 8.8 HIGH | Frappe before 15.41.0 Privilege Escalation via Document Action |
| CVE-2026-109608 | 8.8 HIGH | Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input |
| CVE-2026-109652 | 8.8 HIGH | Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields |
| CVE-2025-71432 | 8.1 HIGH | Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover |
| CVE-2026-109640 | 8.1 HIGH | Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificatio |
| CVE-2026-109633 | 8.1 HIGH | Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page |
| CVE-2026-109671 | 7.3 HIGH | Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages |
| CVE-2026-109653 | 7.3 HIGH | Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover |
| CVE-2026-109673 | 7.3 HIGH | Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names |
| CVE-2026-109604 | 7.3 HIGH | ERPNext before 15.112.0 Stored XSS via Tool View Record Names |
| CVE-2026-109612 | 7.3 HIGH | Frappe ERPNext before 15.120.0 Stored XSS via Report View |
| CVE-2026-109613 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificati |
| CVE-2026-109617 | 7.1 HIGH | Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints |
| CVE-2026-109616 | 7.1 HIGH | Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification |
| CVE-2026-109615 | 6.5 MEDIUM | Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints |
| CVE-2026-109610 | 6.5 MEDIUM | Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modifica |
| CVE-2026-109661 | 6.5 MEDIUM | Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109614 | 6.5 MEDIUM | Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data |
| CVE-2026-109658 | 6.5 MEDIUM | Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints |
| CVE-2026-109601 | 6.5 MEDIUM | Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML |
Showing top 20 of 86 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: erpnext
-
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record -
CVE-2026-109671
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field -
CVE-2026-109670
Frappe ERPNext before 15.110.0 Stored XSS via Item Record Na
Same vendor: frappe
-
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing -
CVE-2026-111388
Frappe before 16.33.0 restrict_ip Allowlist Bypass via API K -
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in
Same weakness: CWE-269
-
CVE-2026-85659
PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege -
CVE-2026-109447
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Es -
CVE-2026-89079
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalati -
CVE-2026-104798
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation -
CVE-2026-111114
Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Pri
V. Comments for CVE-2026-109667
No comments yet