CVE-2026-109637 — Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can sen…
Published: 2026-10-12 · CVSS: 7.1 · CVSS 4.0
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7