CVE-2026-109651 — Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7