CVE-2026-109614
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 12, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 12, 2026
Description
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
erpnextfrappe |
|
References
- GitHub Security Advisory (GHSA-qcff-6669-j3gj)vendor-advisory
- VulnCheck Advisory: Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Datathird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.