High severity8.1NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2026-109640

Description

Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.

Affected products

Frappe/Erpnextllm-fuzzy
Range: <16.22.0

Patches

Vulnerability mechanics

References

github.com/frappe/erpnext/security/advisories/GHSA-c496-q7g2-62vvnvd
www.vulncheck.com/advisories/frappe-erpnext-before-16.22.0-missing-authorization-allows-unauthorized-record-modificationnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000