CVE-2026-109621 — Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforceme…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7